JetFormBuilder is vulnerable to stored cross‑site scripting due to insufficient input sanitization and output escaping on post meta fields. Unauthenticated attackers can inject malicious scripts via the %META::key% macro in a Calculated Field, which is then persisted and executed for any user who views the affected page. The weakness is a classic stored XSS (CWE‑79) affecting confidentiality, integrity, and availability by allowing arbitrary code execution in the victim's browser.

All versions of the JetFormBuilder Dynamic Blocks Form Builder plugin for WordPress up to and including version 3.6.8 are affected. The vulnerability requires that the site has a public Insert Post form that writes to a post meta key and a Calculated Field referencing that key via the %META::key% macro.

The issue has a CVSS score of 7.2, indicating a high severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a site with a publicly accessible Insert Post form that writes to a meta key and a Calculated Field that uses that key. Attackers can succeed with a single unauthenticated POST request after the form configuration is present, suggesting moderate to high risk for sites with the vulnerable configuration.