Crocoblock vulnerabilities, page 5

118 vulnerabilities

Known vulnerabilities in Crocoblock products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 25 products.

6.4MediumCVE-2024-7147crocoblock · jetblocks for elementor +1 moreJetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe JetBlocks for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to, and including, 1.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.29%8.8HighCVE-2024-7145crocoblock · jetelements +1 moreJetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File InclusionThe JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.EPSS0.90%8.8HighCVE-2024-38772crocoblock · jetwidgets for elementor and woocommerce +1 moreWordPress JetWidgets for Elementor and WooCommerce plugin <= 1.1.7 - Contributor+ Limited Local File Inclusion vulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP Local File Inclusion.This issue affects JetWidgets for Elementor and WooCommerce: from n/a through 1.1.7.EPSS0.50%6.4MediumCVE-2024-10323crocoblock · jetwidgets_for_elementor +2 moreJetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadThe JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.EPSS0.32%6.5MediumCVE-2026-105879crocoblock · jetelements for elementor +1 moreWordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.EPSS0.17%5.3MediumCVE-2026-61977crocoblock · jetsearch +1 moreWordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.EPSS0.33%5.3MediumCVE-2026-61976crocoblock · jetblocks for elementor +1 moreWordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.5.0.EPSS0.33%5.3MediumCVE-2026-61975crocoblock · jetreviews +1 moreWordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through <= 3.0.1.EPSS0.33%7.2HighCVE-2026-84817crocoblock · jetformbuilder +1 moreWordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.EPSS0.25%6.5MediumCVE-2026-62049crocoblock · jetblocks for elementor +1 moreWordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.EPSS0.17%9.3CriticalCVE-2026-42774crocoblock · jetengine +1 moreWordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue affects JetEngine: from n/a through 3.8.8.1.EPSS0.40%7.5HighCVE-2026-4352crocoblock · jetengine +1 moreJetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' ParameterThe JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into a SQL query string via `sprintf()` without sanitization or use of `$wpdb->prepare()`. WordPress REST API's `wp_unslash()` call on `$_GET` strips the `wp_magic_quotes()` protection, allowing single-quote-based injection. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Custom Content Types module must be enabled with at least one CCT configured with a public REST GET endpoint for exploitation.EPSS0.46%7.5HighCVE-2026-4662crocoblock · jetengine +1 moreJetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' ParameterThe JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the `prepare_where_clause()` method in the SQL Query Builder not sanitizing the `compare` operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.EPSS0.56%5.3MediumCVE-2026-27347crocoblock · jetpopup +1 moreWordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2.EPSS0.31%7.2HighCVE-2026-94661crocoblock · jetblog +1 moreWordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.EPSS0.18%6.5MediumCVE-2026-94667crocoblock · jetreviews +1 moreWordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.EPSS0.16%7.2HighCVE-2026-93875crocoblock · jetappointment +1 moreJetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' ParameterThe JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the wp_jet_appointments_meta table via the unauthenticated jet_engine_form_booking_submit endpoint and executes in the administrator's browser when the appointment details popup is opened in the WordPress admin panel.EPSS0.19%6.5MediumCVE-2026-24958crocoblock · jetelements for elementor +1 moreWordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.12.2.EPSS0.19%8.8HighCVE-2026-28134crocoblock · jetengine +1 moreWordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerabilityImproper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.EPSS0.41%7.2HighCVE-2026-81760crocoblock · jetengine +1 moreWordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.EPSS0.25%