Threats tagged 'ghsa-h3qq-hvw6-cjjf'

JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress versions up to and including 3.6.5.4 is vulnerable to stored cross-site scripting (XSS) via the 'choice' Post Meta. An unauthenticated attacker can inject malicious scripts through the wp_ajax_nopriv_jet_form_builder_submit endpoint, which are stored in post meta and later rendered without proper escaping. This vulnerability allows arbitrary script execution in users' browsers when they access affected pages.