Crocoblock
Monthly
SQL injection in Crocoblock JetEngine through version 3.9.0 allows an authenticated low-privilege user on a WordPress site to inject SQL and read sensitive database data, with a low availability impact and no user interaction required. The CVSS 3.1 score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), and the issue is prioritized for this week rather than as an emergency because exploitation is gated by authentication. No public exploit code has been identified at time of analysis.
DOM-based cross-site scripting in the Crocoblock JetEngine plugin for WordPress (all versions through 3.8.16) lets remote attackers inject script that executes in a victim's browser when the victim interacts with attacker-controlled input processed by the plugin's client-side JavaScript. The vulnerability is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and carries a mandatory user-interaction requirement, so impact is confined to the browser session of a user who loads or clicks a crafted page or link rather than to the server itself. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); this is a moderate-priority issue rather than an emergency, though the plugin's broad install base on WordPress sites makes prompt patching advisable.
Reflected cross-site scripting in the Crocoblock JetProductTables WordPress plugin (all versions through 1.2.4) allows an unauthenticated attacker to execute arbitrary script in a victim's browser by luring them to a crafted URL, which can lead to session theft or privileged actions such as content injection if an administrator clicks the link. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation depends on user interaction (UI:R) and the payload is not persisted; the advisory reports a base score of 7.1 while our independent impact assessment keeps confidentiality and integrity low with no availability impact. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, making this a social-engineering-dependent risk that matters most on sites where privileged users are likely to click untrusted links.
Reflected cross-site scripting in Crocoblock's JetBlog WordPress plugin (all versions through 2.4.10) lets unauthenticated attackers execute arbitrary script in a victim's browser when that victim loads a crafted request or URL containing unsanitized input. The flaw is reflected rather than stored, so each exploitation requires an individually tricked user and the payload does not persist on the site; impact is greatest when the lured user is an authenticated administrator, allowing session or privileged-action abuse. Assessed at CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and reported by Patchstack, with no public exploit identified at time of analysis and no confirmed active exploitation.
Stored cross-site scripting in the JetAppointment plugin for WordPress (all versions up to and including 2.5.2.1) allows unauthenticated attackers to plant arbitrary JavaScript through the 'friendlyTime' parameter of the public booking form; the payload is persisted in the wp_jet_appointments_meta table and later executes in an administrator's browser when that appointment's details popup is opened in WordPress admin. The injection path requires no authentication and no special non-default setup beyond a live, reachable booking form (the jet_engine_form_booking_submit endpoint), but execution is not automatic - the script lies dormant until a privileged user opens the affected appointment record, so realistic impact hinges on that administrator interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the finding is an elevated-priority issue rather than a drop-everything emergency.
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Reflected cross-site scripting in Crocoblock's JetEngine WordPress plugin (all versions through 3.8.14.2) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to follow a specially crafted URL. The scope-change component of the CVSS vector indicates that successful exploitation breaks out of the plugin's immediate context to affect the broader browser session, enabling session token theft or administrative action impersonation. No public exploit code or active exploitation has been confirmed at time of analysis; the flaw was disclosed by Patchstack.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions up to 3.8.10.1 allows remote attackers to extract database contents via the listing_load_more AJAX handler. The filtered_query parameter is deliberately excluded from the HMAC signature check to enable front-end filter integration, but meta_query row values are merged into SQL without sanitization, enabling time-based or boolean blind injection. No public exploit identified at time of analysis, though the bug was reported by Wordfence and source code locations are publicly referenced.
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attackers to inject crafted SQL into backend queries, leading to high-impact confidentiality disclosure and limited availability impact with a scope change to other components. The flaw carries a CVSS 9.3 rating and was disclosed by Patchstack, but there is no public exploit identified at time of analysis and EPSS is very low at 0.03%.
SQL injection in JetEngine WordPress plugin (≤3.8.6.1) via Custom Content Type REST API allows unauthenticated remote attackers to extract sensitive database information. The vulnerability stems from unsanitized search parameters in REST endpoints, bypassing WordPress's built-in SQL protections. Attack complexity is low (CVSS AC:L) with no user interaction required. EPSS and KEV data not provided; exploitation requires Custom Content Types module enabled with public REST endpoints configured.
The JetEngine plugin for WordPress contains a SQL injection vulnerability in the listing_load_more AJAX action that allows unauthenticated attackers to extract sensitive database information. All versions up to and including 3.8.6.1 are affected. The vulnerability exists on sites using JetEngine Listing Grid with Load More functionality enabled and SQL Query Builder queries, with a CVSS score of 7.5 indicating high severity for confidentiality impact.
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authenticated attackers to inject malicious objects and achieve arbitrary code execution. An attacker with user-level access can exploit this vulnerability without user interaction to fully compromise the affected system. No patch is currently available for this vulnerability.
Cross-site scripting (CWE-80, basic XSS) in Crocoblock JetFormBuilder through 3.6.7.1 allows a remote attacker to inject script-related HTML into plugin-handled form content, which executes in the browser of a user who views the crafted page. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (CVSS 5.3), so victim interaction is required and impact is limited to the browser session; the vendor advisory is a Patchstack entry. No CISA KEV listing or public exploit code is identified in the supplied data; the precise form field or endpoint is not described in the available sources.
Missing authorization in Crocoblock JetFormBuilder through 3.6.7.1 allows remote unauthenticated attackers to perform a limited integrity-impacting action on WordPress sites running the plugin. The issue is CWE-862 broken access control, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N); confidentiality and availability are not affected. No public exploit was identified at time of analysis, and the specific vulnerable action is not described in the available sources.
Stored cross-site scripting in Crocoblock JetElements For Elementor (versions through 2.9.2.6) allows an authenticated user with low-level content-editing privileges to plant persistent script in a widget field, which then executes in the browser of any higher-privileged user who later views the affected page or admin screen. Rated CVSS 6.5 with scope change (S:C), reflecting that code runs in the victim's WordPress session context rather than the attacker's. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the required authenticated foothold plus victim interaction keeps it a medium-priority, this-month remediation item rather than an emergency.
Stored cross-site scripting (CWE-79) in the Crocoblock JetSmartFilters WordPress plugin, affecting versions through 3.8.6.2, allows an authenticated user with low-level privileges to persist script-bearing input that executes in the browser of a different user who later views the affected page. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation requires valid low-privileged credentials plus a victim viewing the stored content, with impact scoped beyond the vulnerable component. No CISA KEV listing and no public exploit code were identified at time of analysis; the vendor-reported issue is tracked as a this-month priority and detailed in Patchstack's advisory.
Stored cross-site scripting in the Crocoblock JetSmartFilters WordPress plugin, affecting versions through 3.8.6.1, lets an authenticated low-privileged user persist script content that later executes in another user's browser when the affected page is loaded. The CVSS 3.1 score of 6.5 includes a scope change (S:C), reflecting that the injected script runs in the victim's browser session rather than in the server's security context. No CISA KEV entry and no public exploit code were identified at the time of analysis, and the issue is prioritized for patching this month rather than treated as an emergency.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (versions from n/a through 2.9.2.5) lets a low-privileged account - contributor or author level - persist a script payload that then executes in another user's browser, typically an administrator's, when the affected page is loaded. The plugin does not neutralize input before it is rendered into a web page (CWE-79), and because the CVSS vector carries a scope change (S:C), the injected script runs with the victim's privileges against the surrounding site rather than staying confined to the vulnerable component. Impact is bounded to confidentiality, integrity and availability at low severity, and no public exploit has been identified at time of analysis, with no CISA KEV entry; the current priority is manage-this-month rather than an emergency response.
Stored cross-site scripting in Crocoblock JetElements For Elementor through version 2.9.2.4 allows an authenticated WordPress user with low-level content privileges to inject a script into a JetElements widget; the payload executes when another user, such as an administrator, views or edits the affected page. The issue is rated CVSS 6.5 and requires victim interaction, so exploitation is constrained by content-authoring permissions and user behavior. No public exploit code or active exploitation was identified at time of analysis.
Stored cross-site scripting (XSS) in the Crocoblock JetSmartFilters WordPress plugin through version 3.8.6 lets an authenticated low-privileged user (CVSS PR:L, e.g., contributor or author) inject a persistent payload into filter-handled input that is improperly neutralized before web page generation, and the script then executes in the browser of a higher-privileged victim such as an administrator who views the affected page (UI:R). The issue is scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), is a moderate-severity CWE-79 defect, and there is no public exploit code or confirmed active exploitation identified at time of analysis; it is not exploitable against a default site without a valid account on the target WordPress installation.
Stored cross-site scripting in Crocoblock JetMenu (a WordPress mega-menu builder plugin) through version 3.0.5 lets an authenticated user with low-level content-authoring privileges inject script that is persisted and later executed in the browser of a higher-privileged viewer such as an administrator or editor. The flaw is rated CVSS 6.5 (Medium) under CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting the need for a valid account (PR:L) and for a victim to render the poisoned menu content (UI:R), with scope change because the injected script runs in the victim's session context. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); risk is concentrated on sites that grant untrusted or low-privilege users menu/content authoring capabilities.
Stored cross-site scripting in Crocoblock's JetElements For Elementor WordPress plugin (all versions through 2.9.2.3) allows an attacker holding a low-privilege account on the target site to persist malicious script through a JetElements input field, which then executes in the browser of any user who views the affected page. The vulnerable path requires an authenticated user with at least contributor/author-level posting capability and depends on a victim later visiting the poisoned content; successful exploitation runs script under the site's own origin, enabling session or credential theft and content/administrative action injection against higher-privileged viewers. There is no public exploit identified at time of analysis and no confirmed active exploitation; the issue is rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) and no patched version is specified in the available advisory data.
Stored cross-site scripting in the Crocoblock JetReviews WordPress plugin (versions through 3.1.2) lets an authenticated low-privilege user persist malicious script inside review content, which then executes in the browser of any visitor who later views the affected review page. Successful exploitation requires a valid account with permission to submit JetReviews content plus a victim who loads the poisoned page, so sites that do not allow untrusted users to post reviews are not exposed in practice. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); no public exploit code was identified and the flaw is not confirmed as actively exploited (not in CISA KEV).
Stored cross-site scripting in Crocoblock's JetBlocks For Elementor WordPress plugin (all versions through 1.5.2.1) allows an authenticated user with low-level privileges to plant persistent JavaScript inside plugin widget content, which then executes in the browser of any administrator or other viewer who loads the affected page - CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored rather than reflected, a single successful injection can fire for every subsequent visitor until the content is cleaned, though it requires both a plugin-reachable account to inject (PR:L) and a victim to view the poisoned page (UI:R), so it does not self-propagate. No public exploit code and no confirmed active exploitation were identified in the available data; severity is driven mainly by the scope change (S:C) and the low-complexity, network-reachable attack path.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (all versions through 2.9.2.2) allows an authenticated user with low privileges, such as a contributor or author, to inject persistent script content that executes in the browser of any other user who later views the affected page, including administrators. Per the independent assessment this is a Medium-severity issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requiring a valid low-privileged account and user interaction, so sites that do not grant untrusted users content-editing roles are substantially less exposed. There is no public exploit identified at time of analysis and no KEV listing, though the reported scope change (S:C) means the injected script can affect resources beyond the vulnerable component's original security context; the vulnerability was reported by Patchstack.
Missing authorization checks in Crocoblock's JetPopup WordPress plugin (versions through 2.0.20.2) allow unauthenticated remote attackers to access functionality or data that should be restricted to authorized users. The flaw, classified as CWE-862 (Missing Authorization), enables exploitation of incorrectly configured access control levels, resulting in low-impact information disclosure with no integrity or availability consequence. No public exploit has been identified at time of analysis, and EPSS and KEV data were not provided.
Unauthenticated sensitive data exposure in Crocoblock JetSearch WordPress plugin (all versions through 3.6.1.2) permits remote attackers to retrieve embedded sensitive system information without any credentials or user interaction. The flaw is classified under CWE-497, indicating the plugin surfaces internal system data through an externally accessible vector. With a network-accessible, zero-privilege attack path confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, any internet-facing WordPress installation running a vulnerable JetSearch version is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive system information exposure in Crocoblock JetBlocks For Elementor (versions through 1.5.0) allows remote unauthenticated attackers to retrieve embedded sensitive data from affected WordPress installations. The flaw, classified under CWE-497, results in unauthorized disclosure of system-level information that should remain restricted to privileged contexts. No public exploit code or active exploitation has been identified at time of analysis, but the absence of authentication requirements lowers the barrier for opportunistic reconnaissance against any site running the vulnerable plugin version.
JetReviews WordPress plugin by Crocoblock (versions through 3.0.1) exposes embedded sensitive system information to unauthenticated remote attackers, classified under CWE-497. The vulnerability permits retrieval of sensitive data that should remain internal to the application - likely API keys, configuration values, or credentials embedded in plugin output or REST endpoints - without requiring any authentication, user interaction, or elevated privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-friction CVSS vector (AV:N/AC:L/PR:N/UI:N) means any internet-facing WordPress site running this plugin version is passively exposed.
The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.18 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up to, and including, 1.0.16 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including, 1.0.15 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.6.10. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.6.13. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder - Dynamic Blocks Form Builder plugin <= 3.0.6 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in Crocoblock JetEngine through version 3.9.0 allows an authenticated low-privilege user on a WordPress site to inject SQL and read sensitive database data, with a low availability impact and no user interaction required. The CVSS 3.1 score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), and the issue is prioritized for this week rather than as an emergency because exploitation is gated by authentication. No public exploit code has been identified at time of analysis.
DOM-based cross-site scripting in the Crocoblock JetEngine plugin for WordPress (all versions through 3.8.16) lets remote attackers inject script that executes in a victim's browser when the victim interacts with attacker-controlled input processed by the plugin's client-side JavaScript. The vulnerability is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and carries a mandatory user-interaction requirement, so impact is confined to the browser session of a user who loads or clicks a crafted page or link rather than to the server itself. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); this is a moderate-priority issue rather than an emergency, though the plugin's broad install base on WordPress sites makes prompt patching advisable.
Reflected cross-site scripting in the Crocoblock JetProductTables WordPress plugin (all versions through 1.2.4) allows an unauthenticated attacker to execute arbitrary script in a victim's browser by luring them to a crafted URL, which can lead to session theft or privileged actions such as content injection if an administrator clicks the link. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation depends on user interaction (UI:R) and the payload is not persisted; the advisory reports a base score of 7.1 while our independent impact assessment keeps confidentiality and integrity low with no availability impact. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, making this a social-engineering-dependent risk that matters most on sites where privileged users are likely to click untrusted links.
Reflected cross-site scripting in Crocoblock's JetBlog WordPress plugin (all versions through 2.4.10) lets unauthenticated attackers execute arbitrary script in a victim's browser when that victim loads a crafted request or URL containing unsanitized input. The flaw is reflected rather than stored, so each exploitation requires an individually tricked user and the payload does not persist on the site; impact is greatest when the lured user is an authenticated administrator, allowing session or privileged-action abuse. Assessed at CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and reported by Patchstack, with no public exploit identified at time of analysis and no confirmed active exploitation.
Stored cross-site scripting in the JetAppointment plugin for WordPress (all versions up to and including 2.5.2.1) allows unauthenticated attackers to plant arbitrary JavaScript through the 'friendlyTime' parameter of the public booking form; the payload is persisted in the wp_jet_appointments_meta table and later executes in an administrator's browser when that appointment's details popup is opened in WordPress admin. The injection path requires no authentication and no special non-default setup beyond a live, reachable booking form (the jet_engine_form_booking_submit endpoint), but execution is not automatic - the script lies dormant until a privileged user opens the affected appointment record, so realistic impact hinges on that administrator interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the finding is an elevated-priority issue rather than a drop-everything emergency.
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Reflected cross-site scripting in Crocoblock's JetEngine WordPress plugin (all versions through 3.8.14.2) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to follow a specially crafted URL. The scope-change component of the CVSS vector indicates that successful exploitation breaks out of the plugin's immediate context to affect the broader browser session, enabling session token theft or administrative action impersonation. No public exploit code or active exploitation has been confirmed at time of analysis; the flaw was disclosed by Patchstack.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions up to 3.8.10.1 allows remote attackers to extract database contents via the listing_load_more AJAX handler. The filtered_query parameter is deliberately excluded from the HMAC signature check to enable front-end filter integration, but meta_query row values are merged into SQL without sanitization, enabling time-based or boolean blind injection. No public exploit identified at time of analysis, though the bug was reported by Wordfence and source code locations are publicly referenced.
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attackers to inject crafted SQL into backend queries, leading to high-impact confidentiality disclosure and limited availability impact with a scope change to other components. The flaw carries a CVSS 9.3 rating and was disclosed by Patchstack, but there is no public exploit identified at time of analysis and EPSS is very low at 0.03%.
SQL injection in JetEngine WordPress plugin (≤3.8.6.1) via Custom Content Type REST API allows unauthenticated remote attackers to extract sensitive database information. The vulnerability stems from unsanitized search parameters in REST endpoints, bypassing WordPress's built-in SQL protections. Attack complexity is low (CVSS AC:L) with no user interaction required. EPSS and KEV data not provided; exploitation requires Custom Content Types module enabled with public REST endpoints configured.
The JetEngine plugin for WordPress contains a SQL injection vulnerability in the listing_load_more AJAX action that allows unauthenticated attackers to extract sensitive database information. All versions up to and including 3.8.6.1 are affected. The vulnerability exists on sites using JetEngine Listing Grid with Load More functionality enabled and SQL Query Builder queries, with a CVSS score of 7.5 indicating high severity for confidentiality impact.
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authenticated attackers to inject malicious objects and achieve arbitrary code execution. An attacker with user-level access can exploit this vulnerability without user interaction to fully compromise the affected system. No patch is currently available for this vulnerability.
Cross-site scripting (CWE-80, basic XSS) in Crocoblock JetFormBuilder through 3.6.7.1 allows a remote attacker to inject script-related HTML into plugin-handled form content, which executes in the browser of a user who views the crafted page. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (CVSS 5.3), so victim interaction is required and impact is limited to the browser session; the vendor advisory is a Patchstack entry. No CISA KEV listing or public exploit code is identified in the supplied data; the precise form field or endpoint is not described in the available sources.
Missing authorization in Crocoblock JetFormBuilder through 3.6.7.1 allows remote unauthenticated attackers to perform a limited integrity-impacting action on WordPress sites running the plugin. The issue is CWE-862 broken access control, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N); confidentiality and availability are not affected. No public exploit was identified at time of analysis, and the specific vulnerable action is not described in the available sources.
Stored cross-site scripting in Crocoblock JetElements For Elementor (versions through 2.9.2.6) allows an authenticated user with low-level content-editing privileges to plant persistent script in a widget field, which then executes in the browser of any higher-privileged user who later views the affected page or admin screen. Rated CVSS 6.5 with scope change (S:C), reflecting that code runs in the victim's WordPress session context rather than the attacker's. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the required authenticated foothold plus victim interaction keeps it a medium-priority, this-month remediation item rather than an emergency.
Stored cross-site scripting (CWE-79) in the Crocoblock JetSmartFilters WordPress plugin, affecting versions through 3.8.6.2, allows an authenticated user with low-level privileges to persist script-bearing input that executes in the browser of a different user who later views the affected page. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation requires valid low-privileged credentials plus a victim viewing the stored content, with impact scoped beyond the vulnerable component. No CISA KEV listing and no public exploit code were identified at time of analysis; the vendor-reported issue is tracked as a this-month priority and detailed in Patchstack's advisory.
Stored cross-site scripting in the Crocoblock JetSmartFilters WordPress plugin, affecting versions through 3.8.6.1, lets an authenticated low-privileged user persist script content that later executes in another user's browser when the affected page is loaded. The CVSS 3.1 score of 6.5 includes a scope change (S:C), reflecting that the injected script runs in the victim's browser session rather than in the server's security context. No CISA KEV entry and no public exploit code were identified at the time of analysis, and the issue is prioritized for patching this month rather than treated as an emergency.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (versions from n/a through 2.9.2.5) lets a low-privileged account - contributor or author level - persist a script payload that then executes in another user's browser, typically an administrator's, when the affected page is loaded. The plugin does not neutralize input before it is rendered into a web page (CWE-79), and because the CVSS vector carries a scope change (S:C), the injected script runs with the victim's privileges against the surrounding site rather than staying confined to the vulnerable component. Impact is bounded to confidentiality, integrity and availability at low severity, and no public exploit has been identified at time of analysis, with no CISA KEV entry; the current priority is manage-this-month rather than an emergency response.
Stored cross-site scripting in Crocoblock JetElements For Elementor through version 2.9.2.4 allows an authenticated WordPress user with low-level content privileges to inject a script into a JetElements widget; the payload executes when another user, such as an administrator, views or edits the affected page. The issue is rated CVSS 6.5 and requires victim interaction, so exploitation is constrained by content-authoring permissions and user behavior. No public exploit code or active exploitation was identified at time of analysis.
Stored cross-site scripting (XSS) in the Crocoblock JetSmartFilters WordPress plugin through version 3.8.6 lets an authenticated low-privileged user (CVSS PR:L, e.g., contributor or author) inject a persistent payload into filter-handled input that is improperly neutralized before web page generation, and the script then executes in the browser of a higher-privileged victim such as an administrator who views the affected page (UI:R). The issue is scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), is a moderate-severity CWE-79 defect, and there is no public exploit code or confirmed active exploitation identified at time of analysis; it is not exploitable against a default site without a valid account on the target WordPress installation.
Stored cross-site scripting in Crocoblock JetMenu (a WordPress mega-menu builder plugin) through version 3.0.5 lets an authenticated user with low-level content-authoring privileges inject script that is persisted and later executed in the browser of a higher-privileged viewer such as an administrator or editor. The flaw is rated CVSS 6.5 (Medium) under CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting the need for a valid account (PR:L) and for a victim to render the poisoned menu content (UI:R), with scope change because the injected script runs in the victim's session context. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); risk is concentrated on sites that grant untrusted or low-privilege users menu/content authoring capabilities.
Stored cross-site scripting in Crocoblock's JetElements For Elementor WordPress plugin (all versions through 2.9.2.3) allows an attacker holding a low-privilege account on the target site to persist malicious script through a JetElements input field, which then executes in the browser of any user who views the affected page. The vulnerable path requires an authenticated user with at least contributor/author-level posting capability and depends on a victim later visiting the poisoned content; successful exploitation runs script under the site's own origin, enabling session or credential theft and content/administrative action injection against higher-privileged viewers. There is no public exploit identified at time of analysis and no confirmed active exploitation; the issue is rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) and no patched version is specified in the available advisory data.
Stored cross-site scripting in the Crocoblock JetReviews WordPress plugin (versions through 3.1.2) lets an authenticated low-privilege user persist malicious script inside review content, which then executes in the browser of any visitor who later views the affected review page. Successful exploitation requires a valid account with permission to submit JetReviews content plus a victim who loads the poisoned page, so sites that do not allow untrusted users to post reviews are not exposed in practice. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); no public exploit code was identified and the flaw is not confirmed as actively exploited (not in CISA KEV).
Stored cross-site scripting in Crocoblock's JetBlocks For Elementor WordPress plugin (all versions through 1.5.2.1) allows an authenticated user with low-level privileges to plant persistent JavaScript inside plugin widget content, which then executes in the browser of any administrator or other viewer who loads the affected page - CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored rather than reflected, a single successful injection can fire for every subsequent visitor until the content is cleaned, though it requires both a plugin-reachable account to inject (PR:L) and a victim to view the poisoned page (UI:R), so it does not self-propagate. No public exploit code and no confirmed active exploitation were identified in the available data; severity is driven mainly by the scope change (S:C) and the low-complexity, network-reachable attack path.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (all versions through 2.9.2.2) allows an authenticated user with low privileges, such as a contributor or author, to inject persistent script content that executes in the browser of any other user who later views the affected page, including administrators. Per the independent assessment this is a Medium-severity issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requiring a valid low-privileged account and user interaction, so sites that do not grant untrusted users content-editing roles are substantially less exposed. There is no public exploit identified at time of analysis and no KEV listing, though the reported scope change (S:C) means the injected script can affect resources beyond the vulnerable component's original security context; the vulnerability was reported by Patchstack.
Missing authorization checks in Crocoblock's JetPopup WordPress plugin (versions through 2.0.20.2) allow unauthenticated remote attackers to access functionality or data that should be restricted to authorized users. The flaw, classified as CWE-862 (Missing Authorization), enables exploitation of incorrectly configured access control levels, resulting in low-impact information disclosure with no integrity or availability consequence. No public exploit has been identified at time of analysis, and EPSS and KEV data were not provided.
Unauthenticated sensitive data exposure in Crocoblock JetSearch WordPress plugin (all versions through 3.6.1.2) permits remote attackers to retrieve embedded sensitive system information without any credentials or user interaction. The flaw is classified under CWE-497, indicating the plugin surfaces internal system data through an externally accessible vector. With a network-accessible, zero-privilege attack path confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, any internet-facing WordPress installation running a vulnerable JetSearch version is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive system information exposure in Crocoblock JetBlocks For Elementor (versions through 1.5.0) allows remote unauthenticated attackers to retrieve embedded sensitive data from affected WordPress installations. The flaw, classified under CWE-497, results in unauthorized disclosure of system-level information that should remain restricted to privileged contexts. No public exploit code or active exploitation has been identified at time of analysis, but the absence of authentication requirements lowers the barrier for opportunistic reconnaissance against any site running the vulnerable plugin version.
JetReviews WordPress plugin by Crocoblock (versions through 3.0.1) exposes embedded sensitive system information to unauthenticated remote attackers, classified under CWE-497. The vulnerability permits retrieval of sensitive data that should remain internal to the application - likely API keys, configuration values, or credentials embedded in plugin output or REST endpoints - without requiring any authentication, user interaction, or elevated privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-friction CVSS vector (AV:N/AC:L/PR:N/UI:N) means any internet-facing WordPress site running this plugin version is passively exposed.
The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.18 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up to, and including, 1.0.16 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including, 1.0.15 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.6.10. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.6.13. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder - Dynamic Blocks Form Builder plugin <= 3.0.6 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.