The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to store malicious script code that is later served to site users. This stored Cross‑Site Scripting can enable the execution of arbitrary JavaScript in the context of a visitor or administrator, potentially leading to session hijacking or site defacement.

Crocoblock JetFormBuilder plugin, versions up to and including 3.6.8. Any WordPress site that has installed jetformbuilder through its latest 3.6.8 release is affected.

The CVSS score of 7.1 classifies the issue as high severity. EPSS data is not available, making the likelihood of exploitation uncertain, but the vulnerability is listed as not in CISA KEV. The most probable attack vector involves a user submitting data through a JetFormBuilder form that is later stored and displayed. An attacker who can inject script into form fields could trigger the XSS when the content is rendered for any visitor.