Jetblog
Monthly
Reflected cross-site scripting in Crocoblock's JetBlog WordPress plugin (all versions through 2.4.10) lets unauthenticated attackers execute arbitrary script in a victim's browser when that victim loads a crafted request or URL containing unsanitized input. The flaw is reflected rather than stored, so each exploitation requires an individually tricked user and the payload does not persist on the site; impact is greatest when the lured user is an authenticated administrator, allowing session or privileged-action abuse. Assessed at CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and reported by Patchstack, with no public exploit identified at time of analysis and no confirmed active exploitation.
Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.
Stored cross-site scripting in the JetBlog WordPress plugin through version 2.4.10 lets an attacker holding a Contributor-level account on the site plant a script payload in JetBlog-provided content that is later rendered without output encoding. Because the CVSS vector is PR:L/UI:R with a scope change, exploitation requires both an authenticated Contributor (or higher) account and a victim - a privileged user or site visitor - who views the crafted content, at which point script executes in that victim's browser session with only low confidentiality and integrity impact. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), so this is assessed as a moderate, not urgent, priority that primarily matters on multi-author WordPress sites where untrusted or loosely vetted Contributor accounts exist.
Reflected cross-site scripting in Crocoblock's JetBlog WordPress plugin (all versions through 2.4.10) lets unauthenticated attackers execute arbitrary script in a victim's browser when that victim loads a crafted request or URL containing unsanitized input. The flaw is reflected rather than stored, so each exploitation requires an individually tricked user and the payload does not persist on the site; impact is greatest when the lured user is an authenticated administrator, allowing session or privileged-action abuse. Assessed at CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and reported by Patchstack, with no public exploit identified at time of analysis and no confirmed active exploitation.
Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.
Stored cross-site scripting in the JetBlog WordPress plugin through version 2.4.10 lets an attacker holding a Contributor-level account on the site plant a script payload in JetBlog-provided content that is later rendered without output encoding. Because the CVSS vector is PR:L/UI:R with a scope change, exploitation requires both an authenticated Contributor (or higher) account and a victim - a privileged user or site visitor - who views the crafted content, at which point script executes in that victim's browser session with only low confidentiality and integrity impact. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), so this is assessed as a moderate, not urgent, priority that primarily matters on multi-author WordPress sites where untrusted or loosely vetted Contributor accounts exist.