Skip to content
OpenAdvisories

Vendor

Crocoblock

126 known vulnerabilities.

Crocoblock at a glance

Last 12 months
54
Critical · all time
5
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 13 25 December 2025: 6 vulnerabilities Dec 2025 January 2026: 2 vulnerabilities February 2026: 2 vulnerabilities March 2026: 4 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 1 vulnerability, 1 critical June 2026: 2 vulnerabilities, 1 critical Jun July 2026: 3 vulnerabilities August 2026: 1 vulnerability September 2026: 3 vulnerabilities Sep October 2026: 21 vulnerabilities November 2026: 8 vulnerabilities, 1 critical
Show as table
MonthVulnerabilitiesCritical
Nov 202681
Oct 2026210
Sep 202630
Aug 202610
Jul 202630
Jun 202621
May 202611
Apr 202610
Mar 202640
Feb 202620
Jan 202620
Dec 202560
Nov 202500
Oct 2025101
Sep 202500
Aug 2025150
Jul 202580
Jun 202500
May 202560
Apr 202570
Mar 202550
Feb 202500
Jan 202530
Dec 202400

Products

JetEngine 26 JetElements For Elementor 18 JetFormBuilder 12 JetBlocks For Elementor 9 JetTabs 7 JetSearch 7 JetSmartFilters 6 JetBlog 6 JetPopup 6 JetWooBuilder 5 JetReviews 4 JetMenu 3 JetTricks 3 JetElements 3 JetProductGallery 2 JetFormBuilder – Hierarchical Select 1 JetWidgets for Elementor and WooCommerce 1 JetThemeCore 1 JetAppointment 1 JetCompareWishlist 1 JetFormBuilder — Dynamic Blocks Form Builder 1 JetGridBuilder 1 JetProductTables 1 JetBooking 1
All Critical High Medium Low Exploited only Public exploit

126 results · Feed

  • High 7.1
    CVE-2026-123482

    WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

    Crocoblock JetFormBuilder
  • High 7.1
    CVE-2026-123484

    WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

    Crocoblock JetFormBuilder
  • Medium 5.3
    CVE-2026-123860

    WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

    Crocoblock JetFormBuilder
  • Medium 5.3
    CVE-2026-123861

    WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – …

    Crocoblock JetFormBuilder – Hierarchical Select
  • Medium 5.3
    CVE-2026-123483

    WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

    Crocoblock JetFormBuilder
  • Medium 6.5
    CVE-2026-123477

    WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.0.2.

    Crocoblock JetEngine
  • Critical 9.8
    CVE-2026-119481

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

    Crocoblock JetFormBuilder
  • Medium 6.5
    CVE-2026-119480

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

    Crocoblock JetFormBuilder
  • Medium 5.3
    CVE-2026-119479

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

    Crocoblock JetFormBuilder
  • Medium 5.3
    CVE-2026-119482

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

    Crocoblock JetFormBuilder
  • Medium 6.5
    CVE-2026-39737

    WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.

    Crocoblock JetElements For Elementor
  • High 8.5
    CVE-2026-39736

    WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2026-116857

    WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.

    Crocoblock JetSmartFilters
  • Medium 6.5
    CVE-2026-39735

    WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2026-114708

    WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1.

    Crocoblock JetSmartFilters
  • Medium 6.5
    CVE-2026-114707

    WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5.

    Crocoblock JetElements For Elementor
  • High 8.5
    CVE-2026-115608

    WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2026-111414

    WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4.

    Crocoblock JetElements For Elementor
  • Medium 6.5
    CVE-2026-110890

    WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.

    Crocoblock JetSmartFilters
  • High 7.1
    CVE-2026-107870

    WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.

    Crocoblock JetEngine
  • High 7.1
    CVE-2026-107867

    WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.

    Crocoblock JetProductTables
  • High 7.5
    CVE-2026-107431

    WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.

    Crocoblock JetFormBuilder
  • Medium 6.5
    CVE-2026-107865

    WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.

    Crocoblock JetMenu
  • Medium 6.5
    CVE-2026-107866

    WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

    Crocoblock JetElements For Elementor
  • Medium 6.5
    CVE-2026-94667

    WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.

    Crocoblock JetReviews
  • High 7.1
    CVE-2026-94661

    WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.

    Crocoblock JetBlog
  • Medium 6.5
    CVE-2026-62049

    WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.

    Crocoblock JetBlocks For Elementor
  • Medium 6.5
    CVE-2026-105879

    WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.

    Crocoblock JetElements For Elementor
  • High 7.2
    CVE-2026-93875

    JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter

    The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthen…

    Crocoblock JetAppointment Web / CMS
  • High 7.1
    CVE-2026-97237

    WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

    Crocoblock JetEngine
  • High 7.1
    CVE-2026-84817

    WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

    Crocoblock JetFormBuilder
  • Medium 5.3
    CVE-2026-27347

    WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2.

    Crocoblock JetPopup
  • High 7.1
    CVE-2026-81760

    WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.

    Crocoblock JetEngine
  • Medium 5.3
    CVE-2026-61976

    WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.5.0.

    Crocoblock JetBlocks For Elementor
  • Medium 5.3
    CVE-2026-61975

    WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through <= 3.0.1.

    Crocoblock JetReviews
  • Medium 5.3
    CVE-2026-61977

    WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.

    Crocoblock JetSearch
  • Critical 9.3
    CVE-2026-49076

    WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.

    Crocoblock JetEngine
  • High 7.5
    CVE-2026-12360

    JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint

    The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support…

    Crocoblock JetEngine Web / CMS
  • Critical 9.3
    CVE-2026-42774

    WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue affects JetEngine: from n/a through 3.8.8.1.

    Crocoblock JetEngine
  • High 7.5
    CVE-2026-4352

    JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter

    The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into a SQL query…

    Crocoblock JetEngine Web / CMS