CVE-2026-66572
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The JetBlog plugin in versions up to and including 2.4.10 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
Risk Assessment
The script may execute in the browsers of other users, including administrators, enabling session theft or account takeover. This can lead to compromise of the WordPress site.
Recommendation
Update the JetBlog plugin to a version newer than 2.4.10. Until then, limit the number of accounts with Contributor privileges.
Other vulnerabilities in JetBlog
See all- CVE-2026-52696High
In JetBlog versions up to 2.4.8, there is a vulnerability allowing unauthorized access to sensitive data.
- CVE-2025-68503Medium
The JetBlog plugin by Crocoblock is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects JetBlog versions from n/a through 2.4.7.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS