The vulnerability in JetFormBuilder allows an unauthenticated attacker to inject arbitrary JavaScript into a page by exploiting the unvalidated 'jfb_xss' URL query variable that is echoed through a calculated field. The plugin does not perform input sanitization or output escaping, so user‑crafted scripts are executed in the victim’s browser. This can lead to theft of session cookies, defacement of the page, or execution of further malicious actions, a classic instance of input validation failure described by CWE‑79.

All versions of the JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress up to and including 3.6.5.3. The flaw is present when a form configuration includes both a URL Query Variable preset field and a calculated field that references that variable, which are standard features of the plugin.

The CVSS score of 6.1 classifies the issue as moderate. Exploitation requires the victim to click a crafted link that contains the vulnerable 'jfb_xss' parameter and the site must host a form with the specific configuration. Because user interaction is necessary, the likelihood of blind exploitation is lower than purely remote exploits, and the vulnerability is not listed in CISA’s KEV catalog. No EPSS data is available. Nonetheless, the impact on confidentiality, integrity and availability can be significant if the plotted scripts compromise credentials or modify site content.