The JetFormBuilder plugin for WordPress contains a basic cross‑site scripting flaw caused by failure to neutralize script‑related HTML tags that appear in form content. An attacker can inject arbitrary JavaScript that will execute in the browsers of users who view the affected page. This could compromise user sessions, deface site content, or facilitate secondary attacks by exfiltrating credentials or delivering malware.

All WordPress sites that have installed the Crocoblock JetFormBuilder plugin in any version from the earliest release through 3.6.7.1 are vulnerable. The flaw is present wherever the plugin is actively rendering form markup in the public‑facing portions of the site.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is remote, delivered via a malicious payload submitted through the plugin’s form fields; the form must be accessible to the target user for exploitation to succeed. The EPSS score is not available, so the probability of exploitation remains uncertain but could rise if attackers discover an easy method to insert payloads into form submissions.