CVE-2026-94661
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The JetBlog plugin for WordPress (up to version 2.4.10) contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. An unauthenticated attacker can inject malicious JavaScript that executes in the victim's browser.
Risk Assessment
An attacker can hijack user sessions, steal cookies, or redirect users to malicious sites. For administrator accounts, this could lead to full compromise of the WordPress site.
Recommendation
Update the JetBlog plugin to the latest version available from the vendor (above 2.4.10). If updating is not possible, consider disabling the plugin until a patch is released.
Other vulnerabilities in JetBlog
See all- CVE-2026-52696High
In JetBlog versions up to 2.4.8, there is a vulnerability allowing unauthorized access to sensitive data.
- CVE-2026-66572Medium
The JetBlog plugin in versions up to and including 2.4.10 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
- CVE-2025-68503Medium
The JetBlog plugin by Crocoblock is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects JetBlog versions from n/a through 2.4.7.
- CVE-2025-49933Medium
Reflected XSS vulnerability in JetBlog up to version 2.4.4. An attacker can send a crafted link that executes a script in the victim's browser.
- CVE-2025-49932Medium
Stored XSS vulnerability in JetBlog up to version 2.4.4.1. An attacker can store a malicious script that executes when the page is viewed.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS