Crocoblock vulnerabilities

Products

• JetEngine 28
• JetElements For Elementor 18
• JetFormBuilder 13
• JetBlocks For Elementor 9
• JetElements 8
• jetwidgets for elementor 8
• JetSearch 7
• JetTabs 7
• JetBlog 6
• JetPopup 6
• JetSmartFilters 6
• JetWooBuilder 5
• JetReviews 4
• JetMenu 3
• JetTricks 3
• JetProductGallery 2
• JetAppointment 1
• JetBooking 1
• JetCompareWishlist 1
• jetengine for elementor 1
• JetFormBuilder – Hierarchical Select 1
• JetFormBuilder — Dynamic Blocks Form Builder 1
• JetGridBuilder 1
• JetProductTables 1
• jettabs for elementor 1
• JetThemeCore 1
• JetWidgets for Elementor and WooCommerce 1

Latest Crocoblock CVEs

Newest publication first · page 1 of 6

1. CVE-2026-123482 WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-09

   High·CVSS 7.1 EPSS 0.19%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

2. CVE-2026-123484 WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-09

   High·CVSS 7.1 EPSS 0.19%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

3. CVE-2026-123860 WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.27%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

4. CVE-2026-123861 WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.26%

   Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select:...

5. CVE-2026-123483 WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.19%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

6. CVE-2026-123477 WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-07

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.0.2.

7. CVE-2026-119481 WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability

   Published 2026-11-04

   Critical·CVSS 9.8 EPSS 0.42%

   Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

8. CVE-2026-119480 WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

   Published 2026-11-01

   Medium·CVSS 6.5 EPSS 0.40%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

9. CVE-2026-119479 WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability

   Published 2026-10-30

   Medium·CVSS 5.3 EPSS 0.31%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

10. CVE-2026-119482 WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability

    Published 2026-10-30

    Medium·CVSS 5.3 EPSS 0.27%

    Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

11. CVE-2026-39737 WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-29

    Medium·CVSS 6.5 EPSS 0.17%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.

12. CVE-2026-39736 WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability

    Published 2026-10-29

    High·CVSS 8.5 EPSS 0.31%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.

13. CVE-2026-116857 WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-29

    Medium·CVSS 6.5 EPSS 0.20%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.

14. CVE-2026-39735 WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

    Published 2026-10-29

    Medium·CVSS 6.5 EPSS 0.27%

    Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.

15. CVE-2026-114708 WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-26

    Medium·CVSS 6.5 EPSS 0.17%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1.

16. CVE-2026-114707 WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-26

    Medium·CVSS 6.5 EPSS 0.18%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5.

17. CVE-2026-115608 WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability

    Published 2026-10-26

    High·CVSS 8.5 EPSS 0.29%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.

18. CVE-2026-111414 WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-19

    Medium·CVSS 6.5 EPSS 0.13%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4.

19. CVE-2026-110890 WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-15

    Medium·CVSS 6.5 EPSS 0.16%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.

20. CVE-2026-107870 WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-14

    High·CVSS 7.1 EPSS 0.24%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.

21. CVE-2026-107867 WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-14

    High·CVSS 7.1 EPSS 0.20%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.

22. CVE-2026-107431 WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability

    Published 2026-10-14

    High·CVSS 7.5 EPSS 0.32%

    Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.

23. CVE-2026-107865 WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-12

    Medium·CVSS 6.5 EPSS 0.13%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.

24. CVE-2026-107866 WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-12

    Medium·CVSS 6.5 EPSS 0.13%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

25. CVE-2026-94667 WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-09

    Medium·CVSS 6.5 EPSS 0.16%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.