CVE-2026-97342 is a stored Cross-Site Scripting vulnerability in the JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin. The flaw exists due to insufficient input sanitization and output escaping of the 'choice' Post Meta data submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint. The malicious payload is stored verbatim in post meta through the Insert/Update Post action and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content. This allows unauthenticated attackers to inject scripts that execute in the context of users visiting the affected pages.

An unauthenticated attacker can inject arbitrary JavaScript code into pages generated by the vulnerable plugin. This can lead to the execution of malicious scripts in the browsers of users who view the affected pages, potentially resulting in session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to the vulnerable plugin or the affected AJAX endpoint to prevent exploitation. Monitoring for updates from the vendor is advised.