CVE-2026-62049
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS. This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.
Risk Assessment
A stored malicious script may execute in the browser of a user visiting the site, potentially leading to session or data theft. This affects WordPress sites using the vulnerable plugin.
Recommendation
Update the JetBlocks For Elementor plugin to a version later than 1.5.2.1. Review content and comments for injected scripts.
Other vulnerabilities in JetBlocks For Elementor
See all- CVE-2026-66576Medium
The JetBlocks For Elementor plugin in versions up to and including 1.5.2 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.
- CVE-2026-61976Medium
The JetBlocks For Elementor WordPress plugin version 1.5.0 and earlier exposes sensitive system information to unauthorized parties. The vulnerability allows reading embedded confidential data.
- CVE-2025-49934Medium
Stored XSS vulnerability in JetBlocks For Elementor up to version 1.3.18. An attacker can store a malicious script that executes when the page is viewed.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS