JetBlocks for Elementor CVE-2026-62049

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) that can reach and submit data into a JetBlocks For Elementor widget/field on a site running the plugin at version 1.5.2.1 or earlier. Execution of the stored payload additionally requires a victim (typically an administrator or another viewer) to load the page rendering the injected content (UI:R) - the script does not fire autonomously. Limiting factors: the attacker must first obtain a valid plugin-reachable account, the specific vulnerable field/role determines who can inject, and successful impact depends on a privileged user subsequently viewing the malicious content. The exact minimum role is not specified in the provided data and should be confirmed with the vendor advisory.

This is a moderate-severity Stored XSS (CWE-79) in the Crocoblock JetBlocks For Elementor WordPress plugin, scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The CVSS vector signals network-reachable, low-complexity exploitation but requires authenticated low privileges (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in the victim's browser context rather than only the vulnerable component. There is NO CISA KEV listing and NO public exploit code identified in the provided data, and EPSS is not supplied - so there is no signal of active or probable near-term exploitation. No SSVC decision data was provided. The combined picture (authenticated precondition + required user interaction + no exploitation signals) places this as a genuine but non-urgent, defense-in-depth priority rather than a critical emergency: it is a real flaw to patch on a normal cycle, not a high-CVSS-but-illusory issue, but also not a mass-exploitation threat on current evidence. Note: the authenticated precondition (PR:L) depends on the WordPress role actually permitted to reach the vulnerable input - verify the minimum role with the Patchstack advisory, as this materially changes real-world risk.

An authenticated low-privileged WordPress user (e.g., contributor/author with access to a JetBlocks widget field) submits content containing a malicious script payload that is stored by the plugin. When an administrator or other user later views the page or dashboard area rendering that content, the script executes in their browser session, enabling session/cookie theft or admin-context actions. No public proof-of-concept exploit was identified in the provided data, so weaponization effort is unknown.