Threats tagged 'ghsa-rvj6-28rw-4w42'

JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress versions up to 3.6.6 is vulnerable to reflected DOM-based cross-site scripting (XSS). The vulnerability arises from insufficient input sanitization and output escaping of a query parameter matching the preset's query_var setting. An unauthenticated attacker can exploit this by tricking a user into clicking a crafted link, causing arbitrary script execution on pages embedding a form with specific text field configurations. This vulnerability has a medium severity rating with a CVSS score of 4.7.