CVE-2026-57354 is a CWE-79 cross-site scripting vulnerability in JetReviews by Crocoblock. Jetimpex Inc. It affects versions up to 3.0.0.1 and allows subscriber-level users to inject malicious scripts due to improper input neutralization during web page generation. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the subscriber level, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation of this vulnerability could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of data, or denial of service conditions. The impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit subscriber privileges where possible and monitor for suspicious activity related to user-generated content. Avoid relying on this vulnerability being mitigated without vendor confirmation.