Crocoblock JetEngine CVE-2026-107870

Exploitation requires a victim to interact with attacker-controlled input (UI:R) - typically clicking a crafted link or loading a page where JetEngine's client-side JavaScript processes unsanitized input into the DOM. The flaw affects all JetEngine versions up to and including 3.8.16 on WordPress sites running the plugin. Realistic risk is limited by the mandatory user-interaction step and by the Low technical impact; the attack does not yield direct server compromise. The Patchstack vector lists no authentication requirement (PR:N), but DOM-based XSS in this plugin class often depends on an authenticated session or an admin viewing attacker-supplied content, so the practical precondition (victim must be a logged-in user, possibly privileged) should be confirmed from the vendor/Patchstack advisory before assuming fully unauthenticated reach.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects network reach, low complexity, and no required privileges, but the scored severity is inflated largely by the scope change (S:C) that XSS flaws conventionally receive, while actual technical impact is only Low across confidentiality, integrity, and availability. Critically, exploitation requires user interaction (UI:R) - a victim must be induced to trigger the malicious DOM context - which meaningfully limits mass or automated exploitation. No EPSS score, CISA KEV listing, or POC availability was provided in the source data, so there is no evidence of active exploitation or a published exploit; this is consistent with a Patchstack-researcher-disclosed WordPress plugin XSS rather than an attacker-weaponized flaw. One signal worth flagging: Patchstack assigns PR:N (unauthenticated), yet DOM-based XSS in WordPress plugins frequently requires at least an authenticated low-privilege account (e.g., contributor) or an admin viewing attacker-influenced data - the exact privilege prerequisite cannot be confirmed from the terse description and should be verified against the Patchstack advisory. Net assessment: a legitimate issue to patch on a normal cycle, not a drop-everything event.

An attacker crafts a malicious URL or input that, when processed by JetEngine's client-side logic, injects attacker-controlled script into the DOM of a page. A logged-in user (potentially an administrator) who clicks the link or views the poisoned content executes the script in their browser session, allowing session-context actions such as limited data theft or forced requests. No public exploit code was identified in the provided data, and the attack hinges on persuading a victim to interact (UI:R).