CVE-2026-66576
MediumCVSS 6.5Summary
The JetBlocks For Elementor plugin in versions up to and including 1.5.2 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.
Risk Assessment
The malicious script may execute in the browsers of other users, including administrators, risking session theft and account takeover. This can ultimately compromise the entire site.
Recommendation
Update the JetBlocks For Elementor plugin to a version newer than 1.5.2. Also consider reviewing Contributor accounts and restricting their privileges.
Other vulnerabilities in JetBlocks For Elementor
See all- CVE-2026-61976Medium
The JetBlocks For Elementor WordPress plugin version 1.5.0 and earlier exposes sensitive system information to unauthorized parties. The vulnerability allows reading embedded confidential data.
- CVE-2025-49934Medium
Stored XSS vulnerability in JetBlocks For Elementor up to version 1.3.18. An attacker can store a malicious script that executes when the page is viewed.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS