Improper Neutralization of Script‑Related HTML Tags allows malicious code to be injected into web pages rendered by JetFormBuilder. This is a basic XSS flaw that can embed script or markup that executes in the victim’s browser. An attacker can use the flaw to deface the site, steal session cookies, or perform other attacks scoped to the site’s user population.

The vulnerability affects Crocoblock’s JetFormBuilder WordPress plugin versions up to and including 3.6.8. All installations running 3.6.8 or earlier are vulnerable; later versions are considered safe.

The CVSS score of 5.3 indicates moderate severity, with the flaw being exploitable via normal web interactions. The EPSS score is not available, and there is no listing in CISA KEV. Attackers could inject arbitrary script by submitting a form on the affected site, which will then be displayed to anyone visiting the page. No privilege escalation is required, so the risk is confined to the web user’s context.