CyberRota Analysis
AI-GeneratedThe JetFormBuilder WordPress plugin prior to version 3.6.5.2 is vulnerable due to improper sanitization of request parameters, enabling unauthenticated users to execute arbitrary shortcodes on any page displaying a form. This flaw can lead to unauthorized content manipulation and potential site compromise. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk.
Original NVD Description
The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later shortcode-expansion pass rather than after it, so the escaping can be bypassed.