The JetFormBuilder WordPress plugin before 3.6.5.2 fails to sanitize the 'status' URL parameter before rendering it as part of a message. This allows any visitor, without authentication, to inject content that is later expanded as a WordPress shortcode. Because escaping occurs after shortcode expansion, malicious users can bypass escaping and cause the execution of any shortcode registered on the site. The result is the ability to run arbitrary code on pages that display a form, potentially leading to remote code execution, data exfiltration, or site takeover. The weakness is a failure to validate and cleanse user input prior to processing, exposing the site to code injection.

Any WordPress installation using JetFormBuilder plugin version earlier than 3.6.5.2 is affected. The vulnerability is present regardless of other plugin or theme versions. Users who have the plugin installed and enable forms on publicly accessible pages are at risk. The identical issue applies across all platforms supported by WordPress (Linux, Windows, macOS).

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, but its impact remains significant. The attacker need not authenticate; the attack vector is likely through any public endpoint that displays a form. Because the exploit exploits a structural flaw rather than a temporary configuration, a skilled attacker can leverage the flaw to execute any shortcode, which can range from innocuous to fully destructive. The risk is elevated in sites with many shortcodes enabled or poorly managed plugin ecosystems.