CVE-2025-49934

MediumCVSS 6.5

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Stored XSS vulnerability in JetBlocks For Elementor up to version 1.3.18. An attacker can store a malicious script that executes when the page is viewed.

Risk Assessment

Potential for account takeover, data theft, or content modification.

Recommendation

Update the JetBlocks For Elementor plugin to a patched version.

Other vulnerabilities in JetBlocks For Elementor

See all

CVE-2026-66576Medium
The JetBlocks For Elementor plugin in versions up to and including 1.5.2 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.
CVE-2026-61976Medium
The JetBlocks For Elementor WordPress plugin version 1.5.0 and earlier exposes sensitive system information to unauthorized parties. The vulnerability allows reading embedded confidential data.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS