The JetFormBuilder plugin for WordPress contains an unescaped input field that stores user‑provided data in post meta, allowing malicious script injection. This stored XSS flaw means that an attacker can embed JavaScript that will execute whenever the affected page is rendered. If successful, the attacker can steal session cookies, deface content or redirect users, impacting confidentiality, integrity, and availability. The weakness is a classic input validation flaw, explicitly identified as CWE‑79.

JetFormBuilder Dynamic Blocks Form Builder, provided by jetmonsters, is vulnerable in all releases up to and including version 3.6.8. The issue originates from the ‘note’ form field value that is written to the note meta key without proper sanitization. WordPress sites using any of these plugin versions should treat the entire plugin release series as affected. No specific WordPress core or other plugins are mentioned as impacted.

The CVSS score of 5.4 places the vulnerability in the medium severity band, while no EPSS score is published and the vulnerability has not entered the CISA KEV list, indicating it has not yet been widely exploited. Exploitation requires an attacker with edit_others_posts capability to trigger the malicious form URL, a situation often achieved through targeted phishing. Once the shortcut page is visited, any user who views the page will run the embedded scripts, so the impact can spread widely within the involved WordPress site. The lack of readily available, widespread exploitation data suggests a moderate threat, but the potential damage warrants quick remediation.