Executive Summary

The WordPress JetFormBuilder Plugin, versions up to and including 3.6.0.1, is vulnerable to an unauthenticated Cross Site Scripting (XSS) attack.

This vulnerability allows attackers to inject malicious scripts, such as redirects or advertisements, which execute when visitors access the site.

Exploitation requires a privileged user to interact with a malicious link, crafted page, or form submission.

The vulnerability has a CVSS score of 7.1, indicating moderate danger and potential for exploitation in mass campaigns targeting numerous websites.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation of this vulnerability can lead to attackers executing malicious scripts on your website.

• Injected scripts can redirect visitors to malicious sites.
• Attackers can display unwanted advertisements or other harmful content.
• It can compromise the integrity and trustworthiness of your website.

This can result in damage to your site's reputation and potentially harm your users.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate action is advised to mitigate this vulnerability.

• Update the JetFormBuilder plugin to version 3.6.1 or later.
• Apply the mitigation rule provided by Patchstack to block attacks until the update is applied.

Useful 0 Not Useful 0