Jetsearch
Monthly
Unauthenticated SQL injection in the JetSearch WordPress plugin (versions <= 3.5.17) allows remote attackers to inject arbitrary SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 9.3 (Critical) score with a scope change, meaning impact extends beyond the plugin to the underlying WordPress database. No public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication requirement make this a high-priority patching target for any WordPress site running the plugin.
Stored cross-site scripting in the JetSearch WordPress plugin (versions 3.6.3 and earlier, published by Crocoblock / Jetimpex Inc.) lets an authenticated user with Contributor-level access plant script-bearing content that executes in the browser of a higher-privileged user who later views it. The attack is unauthenticated only in the sense that no credential is needed by the ultimate victim: the attacker must first hold a low-trust WordPress account (CVSS PR:L), and successful execution depends on a separate admin or editor opening the injected page (UI:R), which keeps real-world exploitation limited. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS data was not supplied, so risk is best characterized as low-to-moderate with a scope-changing (S:C) impact on the affected site.
Unauthenticated sensitive data exposure in Crocoblock JetSearch WordPress plugin (all versions through 3.6.1.2) permits remote attackers to retrieve embedded sensitive system information without any credentials or user interaction. The flaw is classified under CWE-497, indicating the plugin surfaces internal system data through an externally accessible vector. With a network-accessible, zero-privilege attack path confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, any internet-facing WordPress installation running a vulnerable JetSearch version is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated SQL injection in the JetSearch WordPress plugin (versions <= 3.5.17) allows remote attackers to inject arbitrary SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 9.3 (Critical) score with a scope change, meaning impact extends beyond the plugin to the underlying WordPress database. No public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication requirement make this a high-priority patching target for any WordPress site running the plugin.
Stored cross-site scripting in the JetSearch WordPress plugin (versions 3.6.3 and earlier, published by Crocoblock / Jetimpex Inc.) lets an authenticated user with Contributor-level access plant script-bearing content that executes in the browser of a higher-privileged user who later views it. The attack is unauthenticated only in the sense that no credential is needed by the ultimate victim: the attacker must first hold a low-trust WordPress account (CVSS PR:L), and successful execution depends on a separate admin or editor opening the injected page (UI:R), which keeps real-world exploitation limited. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS data was not supplied, so risk is best characterized as low-to-moderate with a scope-changing (S:C) impact on the affected site.
Unauthenticated sensitive data exposure in Crocoblock JetSearch WordPress plugin (all versions through 3.6.1.2) permits remote attackers to retrieve embedded sensitive system information without any credentials or user interaction. The flaw is classified under CWE-497, indicating the plugin surfaces internal system data through an externally accessible vector. With a network-accessible, zero-privilege attack path confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, any internet-facing WordPress installation running a vulnerable JetSearch version is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis.