CVE-2026-61976
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The JetBlocks For Elementor WordPress plugin version 1.5.0 and earlier exposes sensitive system information to unauthorized parties. The vulnerability allows reading embedded confidential data.
Risk Assessment
An attacker can access sensitive system data such as API keys or configurations, potentially leading to further attacks on the infrastructure.
Recommendation
Immediately update the JetBlocks For Elementor plugin to a version newer than 1.5.0 if a security patch is available.
Other vulnerabilities in JetBlocks For Elementor
See all- CVE-2026-66576Medium
The JetBlocks For Elementor plugin in versions up to and including 1.5.2 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.
- CVE-2025-49934Medium
Stored XSS vulnerability in JetBlocks For Elementor up to version 1.3.18. An attacker can store a malicious script that executes when the page is viewed.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.5.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS