CrocoBlock vulnerabilities and threats

107 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.5	EPSS 0.3%	CVE-2026-3496JetBooking (WordPress plugin) · SQL Injection High7.5EPSS 0.3%2026-03-11CVE Database V5CVE-2026-3496 The JetBooking plugin for WordPress is vulnerable to SQL Injection via the 'check_in_date' parameter in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. EPSS 0.3%Vulnerability Crocoblock CWE-89	CVE Database V5	2026-03-11
High	8.5	EPSS 0.3%	CVE-2026-28134JetEngine (WordPress plugin) · Code Injection High8.5EPSS 0.3%2026-03-05CVE Database V5CVE-2026-28134 Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2. EPSS 0.3%Vulnerability Crocoblock	CVE Database V5	2026-03-05
High	7.1	EPSS 0.2%	CVE-2025-68495JetEngine (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-02-20CVE Database V5CVE-2025-68495 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.8.0. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2026-02-20
Medium	6.5	EPSS 0.2%	CVE-2026-24958JetElements For Elementor (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-02-03CVE Database V5CVE-2026-24958 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.12.2. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2026-02-03
High	7.1	EPSS 0.3%	CVE-2025-67923JetEngine (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.3%2026-01-22CVE Database V5CVE-2025-67923 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7. EPSS 0.3%Vulnerability Crocoblock	CVE Database V5	2026-01-22
Medium	4.3	EPSS 0.2%	CVE-2025-69333JetEngine (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.2%2026-01-07CVE Database V5CVE-2025-69333 Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2026-01-07
Medium	6.5	EPSS 0.2%	CVE-2025-68498JetTabs (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.2%2025-12-29CVE Database V5CVE-2025-68498 Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-12-29
Medium	6.5	EPSS 0.2%	CVE-2025-68499JetTabs (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-12-29CVE Database V5CVE-2025-68499 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.12. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-12-29
Medium	4.3	EPSS 0.3%	CVE-2025-68502JetPopup (WordPress plugin) · Insecure Direct Object Reference Medium4.3EPSS 0.3%2025-12-29CVE Database V5CVE-2025-68502 Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetPopup: from n/a through <= 2.0.20.1. EPSS 0.3%Vulnerability Crocoblock	CVE Database V5	2025-12-29
Medium	6.5	EPSS 0.3%	CVE-2025-68503JetBlog (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.3%2025-12-29CVE Database V5CVE-2025-68503 Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetBlog: from n/a through <= 2.4.7. EPSS 0.3%Vulnerability Crocoblock	CVE Database V5	2025-12-29
Medium	6.5	EPSS 0.2%	CVE-2025-68504JetSearch (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-12-29CVE Database V5CVE-2025-68504 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.16. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-12-29
Medium	6.5	EPSS 0.2%	CVE-2025-64355JetElements For Elementor (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-12-18CVE Database V5CVE-2025-64355 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.12. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-12-18
Medium	6.5	EPSS 0.2%	CVE-2025-49939JetElements For Elementor (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-10-22CVE Database V5CVE-2025-49939 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.8. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-10-22
Medium	6.5	EPSS 0.2%	CVE-2025-49938JetEngine (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-10-22CVE Database V5CVE-2025-49938 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-10-22
Medium	6.5	EPSS 0.2%	CVE-2025-49934JetBlocks For Elementor (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-10-22CVE Database V5CVE-2025-49934 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-10-22
Medium	6.5	EPSS 0.2%	CVE-2025-49933JetBlog (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-10-22CVE Database V5CVE-2025-49933 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through <= 2.4.4. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-10-22
Medium	6.5	EPSS 0.2%	CVE-2025-49932JetBlog (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-10-22CVE Database V5CVE-2025-49932 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Stored XSS.This issue affects JetBlog: from n/a through <= 2.4.4.1. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-10-22
Critical	9.3	EPSS 0.5%	CVE-2025-49931JetSearch (WordPress plugin) · SQL Injection Critical9.3EPSS 0.5%2025-10-22CVE Database V5CVE-2025-49931 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects JetSearch: from n/a through 3.5.10. EPSS 0.5%Vulnerability Crocoblock CWE-89	CVE Database V5	2025-10-22
High	7.1	EPSS 0.3%	CVE-2025-49930JetSearch (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.3%2025-10-22CVE Database V5CVE-2025-49930 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Reflected XSS.This issue affects JetSearch: from n/a through <= 3.5.10. EPSS 0.3%Vulnerability Crocoblock	CVE Database V5	2025-10-22
Medium	6.5	EPSS 0.2%	CVE-2025-49928JetWooBuilder (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-10-22CVE Database V5CVE-2025-49928 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows DOM-Based XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20. EPSS 0.2%Vulnerability Crocoblock	CVE Database V5	2025-10-22

Page 3 of 6