Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.

CVE-2026-107870 is a high-severity Cross-site Scripting (XSS) vulnerability in Crocoblock JetEngine. It involves improper neutralization of input during web page generation, leading to a DOM-based XSS issue. This affects JetEngine versions from the initial release up to 3.8.16. The vulnerability allows an attacker to execute malicious scripts in the context of the affected web application, potentially impacting confidentiality, integrity, and availability.

CVE-2026-107867 is a reflected cross-site scripting (XSS) vulnerability in Crocoblock JetProductTables plugin versions up to 1.2.4. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application. The vulnerability has a high severity rating with a CVSS score of 7.1.

CVE-2026-107431 is a missing authorization vulnerability in Crocoblock JetFormBuilder affecting versions from initial releases up to 3.6.6. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially causing denial of service. The vulnerability has a high severity rating with a CVSS score of 7.5. No official patch or remediation details are provided in the available data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

CVE-2026-94667 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetReviews, affecting versions from initial release up to 3.1.2. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the context of users viewing the affected pages. The CVSS score is 6.5, indicating a medium severity level with potential impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the input data, and no known exploits are reported in the wild.

CVE-2026-94661 is a high severity reflected cross-site scripting (XSS) vulnerability in Crocoblock JetBlog plugin versions before 2.4.10.1. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability affects all JetBlog versions from initial releases up to 2.4.10. No official patch or remediation details are provided in the available data.

CVE-2026-62049 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetBlocks For Elementor. It affects versions from initial releases up to 1.5.2.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The CVSS score is 6.5, indicating a medium severity level. No known exploits are reported in the wild. Patch or remediation status is not provided in the available data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the wp_jet_appointments_meta table via the unauthenticated jet_engine_form_booking_submit endpoint and executes in the administrator's browser when the appointment details popup is opened in the WordPress admin panel.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

CVE-2026-97237 is a high-severity DOM-based Cross-site Scripting (XSS) vulnerability in Crocoblock JetEngine. It affects versions from initial releases up to 3.8.14.3. The flaw arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch information is provided in the source data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1.

Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.

Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.

Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.

Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.