JetFormBuilder, a WordPress plugin, allows anyone to submit data through the wp_ajax_nopriv_jet_form_builder_submit endpoint. When the "choice" post meta field is used, the value is stored in the database without sanitization. The Select Field block template later renders this meta value directly into option elements without escaping, resulting in arbitrary JavaScript execution whenever a page containing the post is viewed. The vulnerability is a classic Stored Cross‑Site Scripting (CWE‑79), enabling attackers to run code, deface the site, steal session cookies, and perform malicious actions in the context of site visitors.

JetMonsters JetFormBuilder – Dynamic Blocks Form Builder. All releases up to and including version 3.6.5.4 are affected. Affected sites should update to a newer release to eliminate the flaw.

The CVSS score of 7.2 categorizes this flaw as high severity. Because the Ajax endpoint is unauthenticated, no privileges are required, making exploitation straightforward. Though the EPSS score is not available, the lack of a listed KEV entry does not diminish the risk. An attacker can inject malicious payloads via the public AJAX route, store them, and have them executed for every visitor of the affected page.