CrocoBlock vulnerabilities and threats

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

CVE-2026-94667 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetReviews, affecting versions from initial release up to 3.1.2. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the context of users viewing the affected pages. The CVSS score is 6.5, indicating a medium severity level with potential impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the input data, and no known exploits are reported in the wild.

CVE-2026-94661 is a high severity reflected cross-site scripting (XSS) vulnerability in Crocoblock JetBlog plugin versions before 2.4.10.1. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability affects all JetBlog versions from initial releases up to 2.4.10. No official patch or remediation details are provided in the available data.

CVE-2026-62049 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetBlocks For Elementor. It affects versions from initial releases up to 1.5.2.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The CVSS score is 6.5, indicating a medium severity level. No known exploits are reported in the wild. Patch or remediation status is not provided in the available data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the wp_jet_appointments_meta table via the unauthenticated jet_engine_form_booking_submit endpoint and executes in the administrator's browser when the appointment details popup is opened in the WordPress admin panel.

CVE-2026-97237 is a high-severity DOM-based Cross-site Scripting (XSS) vulnerability in Crocoblock JetEngine. It affects versions from initial releases up to 3.8.14.3. The flaw arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch information is provided in the source data.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

CVE-2026-27347 is a missing authorization vulnerability in Crocoblock JetPopup that allows exploitation of incorrectly configured access control security levels. The issue affects versions up to 2.0.20.2. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-81760 is a high-severity reflected cross-site scripting (XSS) vulnerability in Crocoblock JetEngine. It involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability affects JetEngine versions up to 3.8.14.2. No official patch or remediation guidance is currently available.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.5.0.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through <= 3.0.1.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.

The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue affects JetEngine: from n/a through 3.8.8.1.

Crocoblock JetEngine plugin for WordPress versions up to 3.8.6.1 contains an SQL Injection vulnerability in the Custom Content Type REST API search endpoint. The vulnerability arises because the _cct_search parameter is directly interpolated into a SQL query without proper sanitization or use of prepared statements. This allows unauthenticated attackers to inject SQL commands and potentially extract sensitive database information. Exploitation requires the Custom Content Types module to be enabled with at least one public REST GET endpoint configured. No official patch or remediation guidance has been provided yet.

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the `prepare_where_clause()` method in the SQL Query Builder not sanitizing the `compare` operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.

Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.