The vulnerability in Crocoblock JetFormBuilder is a basic XSS flaw that permits the injection of arbitrary script tags into web pages. This is identified as CWE‑80 and allows an attacker to execute code within the victim’s browser, potentially leading to session hijacking, defacement, or other client‑side attacks. The flaw exists in the plugin’s handling of HTML content, so any content rendered through JetFormBuilder can be subverted.

Affected systems include all installations of the WordPress JetFormBuilder plugin from its earliest release through version 3.6.8. The vendor, Crocoblock, issues a remediation by urging users to upgrade to version 3.6.8.1 or newer. No other version details are specified.

The CVSS score of 5.3 reflects a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The official description does not clarify the exact attack vector or required privileges, so it is inferred that the vulnerability can be triggered by a remote attacker via a maliciously crafted form submission or URL that causes the plugin to render untrusted content. An exploit would require the attacker to trick a legitimate user into visiting a webpage that processes the vulnerable content.