Threats tagged 'ghsa-r622-742w-xwqc'

The JetFormBuilder plugin for WordPress versions up to and including 3.6.7 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts via any form field name parameter. Exploitation requires the targeted form to have the Save Form Record action enabled and a form-level Form Record preset configured. The injected script executes only when a privileged user visits the front-end form page with the attacker's submitted record ID in the preset's record query variable.