Threats tagged 'ghsa-x99m-6rm8-rwmq'

The JetFormBuilder plugin for WordPress up to version 3.6.8 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts via form fields mapped to post meta keys, which execute when users access affected pages. Exploitation requires a public Insert Post form configured to write to a post meta key and a Calculated Field referencing that key. A single unauthenticated POST request can persist the malicious payload.