CVE-2026-94667: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crocoblock JetReviews

CVE-2026-94667 describes a stored cross-site scripting vulnerability in Crocoblock JetReviews, versions prior to 3.1.2.1. The flaw is due to improper neutralization of input during web page generation, which can allow an attacker with low privileges and requiring user interaction to inject and execute malicious scripts. The vulnerability impacts confidentiality, integrity, and availability with a CVSS v3.1 base score of 6.5.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to data disclosure, modification, or disruption of service. The attack requires low privileges and user interaction, and the scope is changed, meaning the impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor Crocoblock's advisories for updates. Until a fix is available, consider restricting user input or applying web application firewall rules to detect and block malicious payloads related to stored XSS in JetReviews.