JetBlog CVE-2026-66572

Requires a valid Contributor-level (or higher) account on a WordPress site running the JetBlog plugin version <= 2.4.10; the attacker injects a script payload through a JetBlog-provided content field/widget that lacks output sanitization. Exploitation is gated by two factors: authentication as a Contributor (PR:L) and required interaction from a victim (UI:R) - a privileged user or visitor must render the malicious content for the script to fire. It is not exploitable by fully unauthenticated attackers and not against sites lacking the plugin.

This is a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) indicates network-reachable but authenticated (PR:L) exploitation that also requires victim interaction (UI:R), which meaningfully caps real-world risk. Two limiting signals converge: the attacker must already hold a Contributor-level WordPress account, and a higher-privileged user (e.g., an editor/admin previewing the post, or a site visitor) must render the injected content. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The S:C (scope change) and low-tri-impact (C:L/I:L/A:L) are consistent with a stored/reflected XSS executing in another security context rather than a direct server compromise. Net: a real but bounded issue typical of authenticated WordPress plugin XSS - worth patching in routine cycles, not an emergency, and lower real risk than the 6.5 headline suggests given the Contributor gate plus required interaction. No data is internally conflicting; the main gap is the absence of a stated fixed version.

An attacker who has registered or obtained a low-privilege Contributor account on a JetBlog-enabled WordPress site submits post content containing a malicious script payload through a JetBlog field that is not properly sanitized. When an editor or administrator previews/reviews that content in the wp-admin dashboard, the script executes in their authenticated browser context (scope change), enabling session/cookie theft or actions on their behalf. No public POC was provided, and exploitation still requires the privileged victim to view the crafted content (UI:R).