JetBlog CVE-2026-94661

Exploitation requires an attacker to deliver a crafted request/URL to a WordPress user and have that victim load it (UI:R) - there is no attacker authentication requirement (PR:N), but the social-engineering step is the primary limiting factor. Because the flaw is reflected (not stored), the malicious input must be present in each request rather than persisting on the site, so each exploitation targets an individually tricked user. Affects JetBlog versions up to and including 2.4.10 on WordPress; impact is maximized when the tricked victim is an authenticated administrator, enabling session or privileged-action abuse via the injected script.

This is a moderate-severity reflected XSS (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reported by Patchstack. The network vector and no-privileges requirement raise its ceiling, but UI:R is the decisive limiter - exploitation requires luring a victim into clicking or loading an attacker-crafted request, so it cannot be mass-automated against servers directly. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope change (S:C) reflects that injected script executes in the victim's browser context outside the vulnerable component's boundary, which is standard for XSS and the reason impacts are rated Low rather than None across C/I/A. No conflicting signals are present, but the complete absence of EPSS/KEV/POC data means real-world exploitation likelihood is unquantified from the input and this should be treated as a patch-in-normal-cycle issue rather than an emergency, weighted by how exposed the affected site's privileged users are to phishing.

An attacker crafts a URL containing a malicious script payload in a parameter processed by a vulnerable JetBlog endpoint and sends it to a logged-in WordPress user (e.g., via phishing or a malicious comment/link). When the victim opens the link, the unsanitized input is reflected into the generated page and the script executes in their browser session. No public proof-of-concept was provided in the input; exploitation is remote but depends on the required user interaction.