An improper neutralization of input during web page generation in the JetFormBuilder plugin permits DOM‑based cross‑site scripting. If an attacker controls a value that is reflected in the generated HTML without proper escaping, they can execute arbitrary JavaScript in the context of a victim’s browser. The consequence is the ability to steal session cookies, deface content, or perform further attacks against the target site.

The vulnerability affects the Crocoblock JetFormBuilder WordPress plugin up to and including version 3.6.8. Any WordPress site that has this plugin installed without a newer release is potentially exposed.

The CVSS score of 7.1 indicates a high severity potential. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a victim visiting a page that includes the vulnerable JetFormBuilder form with a crafted input or URL, enabling an attacker to inject script content without authentication. Because this is a DOM‑based flaw, exploitation requires only that the victim load the page, making it broadly attackable and straightforward for malicious actors.