Jetblocks For Elementor
Monthly
Stored cross-site scripting in Crocoblock's JetBlocks For Elementor WordPress plugin (all versions through 1.5.2.1) allows an authenticated user with low-level privileges to plant persistent JavaScript inside plugin widget content, which then executes in the browser of any administrator or other viewer who loads the affected page - CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored rather than reflected, a single successful injection can fire for every subsequent visitor until the content is cleaned, though it requires both a plugin-reachable account to inject (PR:L) and a victim to view the poisoned page (UI:R), so it does not self-propagate. No public exploit code and no confirmed active exploitation were identified in the available data; severity is driven mainly by the scope change (S:C) and the low-complexity, network-reachable attack path.
Stored cross-site scripting in JetBlocks For Elementor version 1.5.2 and earlier lets an authenticated WordPress user with Contributor-level privileges inject markup that later executes in the browser of a higher-privileged user (administrator or editor) who views the affected content. The flaw carries CVSS 3.1 score 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), and exploitation demands both a low-privilege account on the site and subsequent victim interaction, so it is a moderate, low-priority issue in real-world terms rather than a mass or drive-by attack path. Reported by Patchstack and tracked as EUVD-2026-81497; no public exploit identified at time of analysis.
Sensitive system information exposure in Crocoblock JetBlocks For Elementor (versions through 1.5.0) allows remote unauthenticated attackers to retrieve embedded sensitive data from affected WordPress installations. The flaw, classified under CWE-497, results in unauthorized disclosure of system-level information that should remain restricted to privileged contexts. No public exploit code or active exploitation has been identified at time of analysis, but the absence of authentication requirements lowers the barrier for opportunistic reconnaissance against any site running the vulnerable plugin version.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Reflected XSS.3.8. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in Crocoblock's JetBlocks For Elementor WordPress plugin (all versions through 1.5.2.1) allows an authenticated user with low-level privileges to plant persistent JavaScript inside plugin widget content, which then executes in the browser of any administrator or other viewer who loads the affected page - CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored rather than reflected, a single successful injection can fire for every subsequent visitor until the content is cleaned, though it requires both a plugin-reachable account to inject (PR:L) and a victim to view the poisoned page (UI:R), so it does not self-propagate. No public exploit code and no confirmed active exploitation were identified in the available data; severity is driven mainly by the scope change (S:C) and the low-complexity, network-reachable attack path.
Stored cross-site scripting in JetBlocks For Elementor version 1.5.2 and earlier lets an authenticated WordPress user with Contributor-level privileges inject markup that later executes in the browser of a higher-privileged user (administrator or editor) who views the affected content. The flaw carries CVSS 3.1 score 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), and exploitation demands both a low-privilege account on the site and subsequent victim interaction, so it is a moderate, low-priority issue in real-world terms rather than a mass or drive-by attack path. Reported by Patchstack and tracked as EUVD-2026-81497; no public exploit identified at time of analysis.
Sensitive system information exposure in Crocoblock JetBlocks For Elementor (versions through 1.5.0) allows remote unauthenticated attackers to retrieve embedded sensitive data from affected WordPress installations. The flaw, classified under CWE-497, results in unauthorized disclosure of system-level information that should remain restricted to privileged contexts. No public exploit code or active exploitation has been identified at time of analysis, but the absence of authentication requirements lowers the barrier for opportunistic reconnaissance against any site running the vulnerable plugin version.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Reflected XSS.3.8. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.