A Cross-Site Scripting (XSS) vulnerability exists in Crocoblock JetFormBuilder up to version 3.6.8 due to improper neutralization of script-related HTML tags. This flaw allows code injection via web pages generated by the affected plugin. The vulnerability has a medium severity rating with a CVSS score of 5.3.