CVE-2025-49933
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Reflected XSS vulnerability in JetBlog up to version 2.4.4. An attacker can send a crafted link that executes a script in the victim's browser.
Risk Assessment
Risk of session theft, phishing, or unauthorized actions after clicking a link.
Recommendation
Update the JetBlog plugin to a patched version.
Other vulnerabilities in JetBlog
See all- CVE-2026-52696High
In JetBlog versions up to 2.4.8, there is a vulnerability allowing unauthorized access to sensitive data.
- CVE-2026-94661High
The JetBlog plugin for WordPress (up to version 2.4.10) contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. An unauthenticated attacker can inject malicious JavaScript that executes in the victim's browser.
- CVE-2026-66572Medium
The JetBlog plugin in versions up to and including 2.4.10 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
- CVE-2025-68503Medium
The JetBlog plugin by Crocoblock is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects JetBlog versions from n/a through 2.4.7.
- CVE-2025-49932Medium
Stored XSS vulnerability in JetBlog up to version 2.4.4.1. An attacker can store a malicious script that executes when the page is viewed.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through <= 2.4.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS