Crocoblock Jetimpex Inc
Monthly
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Stored cross-site scripting (XSS) in the JetEngine WordPress plugin, versions through 3.8.15.3, allows an authenticated user with low-level privileges to persist malicious JavaScript that executes in the browser of any user who subsequently views the affected page. The flaw carries a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a scope change with limited confidentiality and integrity impact. Exploitation requires an existing authenticated account on the target WordPress site plus victim interaction, and no public exploit identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
Stored/DOM cross-site scripting in the JetEngine WordPress plugin (Crocoblock / Jetimpex) affects all versions up to and including 3.8.14.3, allowing an authenticated Subscriber-level user to inject markup that executes in the browser of a higher-privileged victim who views or interacts with the affected content. Rated CVSS 5.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L), exploitation requires valid low-privilege credentials plus victim interaction, and the high attack complexity means additional non-trivial conditions must align for the payload to fire, limiting reliable exploitation. No public exploit code has been identified at the time of analysis, and the issue has not been confirmed as actively exploited.
Stored cross-site scripting in the JetTricks WordPress plugin through version 2.0.1 lets an authenticated attacker with low-privilege content-contribution rights (PR:L) inject persistent script that executes in the browser of any user - typically an administrator - who later views the affected page (UI:R). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 6.5, a moderate rather than high priority, and the scope-change component reflects that the payload runs in the viewing user's session context, which may carry more privileges than the injector. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, so the main practical barrier for an attacker is the need for an authenticated account rather than anonymous access.
Stored cross-site scripting in JetElements For Elementor (Crocoblock / JetImpex Inc.) through version 2.9.2.1 allows an authenticated attacker holding the WordPress Contributor role or higher to embed script that executes when a higher-privileged user views or previews the poisoned widget content. It is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79) and the practical exposure is limited to sites that grant low-privilege authoring accounts to untrusted users, since a single-admin or closed-authorship site has essentially no attack surface; the plugin must be installed and active. No public exploit code was identified at time of analysis, the plugin is not listed in CISA KEV, and no EPSS signal was supplied in the source data.
Stored cross-site scripting in the JetSearch WordPress plugin (versions 3.6.3 and earlier, published by Crocoblock / Jetimpex Inc.) lets an authenticated user with Contributor-level access plant script-bearing content that executes in the browser of a higher-privileged user who later views it. The attack is unauthenticated only in the sense that no credential is needed by the ultimate victim: the attacker must first hold a low-trust WordPress account (CVSS PR:L), and successful execution depends on a separate admin or editor opening the injected page (UI:R), which keeps real-world exploitation limited. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS data was not supplied, so risk is best characterized as low-to-moderate with a scope-changing (S:C) impact on the affected site.
Stored cross-site scripting in JetBlocks For Elementor version 1.5.2 and earlier lets an authenticated WordPress user with Contributor-level privileges inject markup that later executes in the browser of a higher-privileged user (administrator or editor) who views the affected content. The flaw carries CVSS 3.1 score 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), and exploitation demands both a low-privilege account on the site and subsequent victim interaction, so it is a moderate, low-priority issue in real-world terms rather than a mass or drive-by attack path. Reported by Patchstack and tracked as EUVD-2026-81497; no public exploit identified at time of analysis.
Stored cross-site scripting in the JetTabs WordPress plugin (Crocoblock / JetImpex Inc.) affects all versions up to and including 2.3.3.1 and allows an authenticated Contributor-level user to inject script that executes in the browser of a higher-privileged user who later views the affected tabs or accordion widget content. Because the injected payload only fires when an administrator, editor, or other privileged user renders the compromised content, exploitation is not automatic and requires the site to grant untrusted users Contributor accounts; the CVSS vector (PR:L, UI:R, S:C) reflects exactly that authenticated-plus-victim-interaction prerequisite. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the issue is best treated as a moderate-severity, low-real-world-priority hardening item for sites with open contributor registration.
Stored cross-site scripting in the JetBlog WordPress plugin through version 2.4.10 lets an attacker holding a Contributor-level account on the site plant a script payload in JetBlog-provided content that is later rendered without output encoding. Because the CVSS vector is PR:L/UI:R with a scope change, exploitation requires both an authenticated Contributor (or higher) account and a victim - a privileged user or site visitor - who views the crafted content, at which point script executes in that victim's browser session with only low confidentiality and integrity impact. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), so this is assessed as a moderate, not urgent, priority that primarily matters on multi-author WordPress sites where untrusted or loosely vetted Contributor accounts exist.
Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point on a publicly reachable WordPress endpoint warrants prompt patching for any internet-facing deployment.
Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.
Server-Side Request Forgery in the JetBooking WordPress plugin (versions up to and including 4.1.2) allows authenticated low-privilege users to force the server to issue arbitrary HTTP requests via the custom role functionality. With a scope-changed CVSS vector (S:C), successful exploitation can expose internal network resources and services not ordinarily reachable from the public internet, yielding limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Stored Cross-Site Scripting in JetReviews plugin for WordPress (versions <= 3.0.0.1) allows subscriber-level authenticated users to inject malicious scripts into review fields that execute in victims' browsers when the content is viewed. The vulnerability carries a changed scope (S:C), meaning the injected payload breaks out of the plugin's context and can target higher-privileged users such as site administrators. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and the prevalence of WordPress in production environments make this a credible escalation path to full site compromise.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Stored cross-site scripting (XSS) in the JetEngine WordPress plugin, versions through 3.8.15.3, allows an authenticated user with low-level privileges to persist malicious JavaScript that executes in the browser of any user who subsequently views the affected page. The flaw carries a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a scope change with limited confidentiality and integrity impact. Exploitation requires an existing authenticated account on the target WordPress site plus victim interaction, and no public exploit identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
Stored/DOM cross-site scripting in the JetEngine WordPress plugin (Crocoblock / Jetimpex) affects all versions up to and including 3.8.14.3, allowing an authenticated Subscriber-level user to inject markup that executes in the browser of a higher-privileged victim who views or interacts with the affected content. Rated CVSS 5.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L), exploitation requires valid low-privilege credentials plus victim interaction, and the high attack complexity means additional non-trivial conditions must align for the payload to fire, limiting reliable exploitation. No public exploit code has been identified at the time of analysis, and the issue has not been confirmed as actively exploited.
Stored cross-site scripting in the JetTricks WordPress plugin through version 2.0.1 lets an authenticated attacker with low-privilege content-contribution rights (PR:L) inject persistent script that executes in the browser of any user - typically an administrator - who later views the affected page (UI:R). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 6.5, a moderate rather than high priority, and the scope-change component reflects that the payload runs in the viewing user's session context, which may carry more privileges than the injector. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, so the main practical barrier for an attacker is the need for an authenticated account rather than anonymous access.
Stored cross-site scripting in JetElements For Elementor (Crocoblock / JetImpex Inc.) through version 2.9.2.1 allows an authenticated attacker holding the WordPress Contributor role or higher to embed script that executes when a higher-privileged user views or previews the poisoned widget content. It is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79) and the practical exposure is limited to sites that grant low-privilege authoring accounts to untrusted users, since a single-admin or closed-authorship site has essentially no attack surface; the plugin must be installed and active. No public exploit code was identified at time of analysis, the plugin is not listed in CISA KEV, and no EPSS signal was supplied in the source data.
Stored cross-site scripting in the JetSearch WordPress plugin (versions 3.6.3 and earlier, published by Crocoblock / Jetimpex Inc.) lets an authenticated user with Contributor-level access plant script-bearing content that executes in the browser of a higher-privileged user who later views it. The attack is unauthenticated only in the sense that no credential is needed by the ultimate victim: the attacker must first hold a low-trust WordPress account (CVSS PR:L), and successful execution depends on a separate admin or editor opening the injected page (UI:R), which keeps real-world exploitation limited. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS data was not supplied, so risk is best characterized as low-to-moderate with a scope-changing (S:C) impact on the affected site.
Stored cross-site scripting in JetBlocks For Elementor version 1.5.2 and earlier lets an authenticated WordPress user with Contributor-level privileges inject markup that later executes in the browser of a higher-privileged user (administrator or editor) who views the affected content. The flaw carries CVSS 3.1 score 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), and exploitation demands both a low-privilege account on the site and subsequent victim interaction, so it is a moderate, low-priority issue in real-world terms rather than a mass or drive-by attack path. Reported by Patchstack and tracked as EUVD-2026-81497; no public exploit identified at time of analysis.
Stored cross-site scripting in the JetTabs WordPress plugin (Crocoblock / JetImpex Inc.) affects all versions up to and including 2.3.3.1 and allows an authenticated Contributor-level user to inject script that executes in the browser of a higher-privileged user who later views the affected tabs or accordion widget content. Because the injected payload only fires when an administrator, editor, or other privileged user renders the compromised content, exploitation is not automatic and requires the site to grant untrusted users Contributor accounts; the CVSS vector (PR:L, UI:R, S:C) reflects exactly that authenticated-plus-victim-interaction prerequisite. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the issue is best treated as a moderate-severity, low-real-world-priority hardening item for sites with open contributor registration.
Stored cross-site scripting in the JetBlog WordPress plugin through version 2.4.10 lets an attacker holding a Contributor-level account on the site plant a script payload in JetBlog-provided content that is later rendered without output encoding. Because the CVSS vector is PR:L/UI:R with a scope change, exploitation requires both an authenticated Contributor (or higher) account and a victim - a privileged user or site visitor - who views the crafted content, at which point script executes in that victim's browser session with only low confidentiality and integrity impact. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), so this is assessed as a moderate, not urgent, priority that primarily matters on multi-author WordPress sites where untrusted or loosely vetted Contributor accounts exist.
Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point on a publicly reachable WordPress endpoint warrants prompt patching for any internet-facing deployment.
Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.
Server-Side Request Forgery in the JetBooking WordPress plugin (versions up to and including 4.1.2) allows authenticated low-privilege users to force the server to issue arbitrary HTTP requests via the custom role functionality. With a scope-changed CVSS vector (S:C), successful exploitation can expose internal network resources and services not ordinarily reachable from the public internet, yielding limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Stored Cross-Site Scripting in JetReviews plugin for WordPress (versions <= 3.0.0.1) allows subscriber-level authenticated users to inject malicious scripts into review fields that execute in victims' browsers when the content is viewed. The vulnerability carries a changed scope (S:C), meaning the injected payload breaks out of the plugin's context and can target higher-privileged users such as site administrators. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and the prevalence of WordPress in production environments make this a credible escalation path to full site compromise.