CVE-2026-62049— WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability
Quick assessment
Affected
Crocoblock JetBlocks For Elementor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Crocoblock JetBlocks For Elementor jet-blocks 插件中，存在“网页生成过程中对输入内容处理不当（跨站脚本攻击，XSS）”漏洞，可导致存储型 XSS。该漏洞影响 JetBlocks For Elementor 插件的以下版本：从 n/a 到 1.5.2.1。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-62049
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Crocoblock | JetBlocks For Elementor | 0 ~ 1.5.2.1 | - |
|
II. Public POCs for CVE-2026-62049
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62049
请登录查看更多情报信息。
Other References for CVE-2026-62049 (1)
Same Patch Batch · Crocoblock · 2026-10-09 · 3 CVEs total
| CVE-2026-94661 | 7.1 HIGH | WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-94667 | 6.5 MEDIUM | WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability |
IV. Related Vulnerabilities
Same product: JetBlocks For Elementor
-
CVE-2026-66576
WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Si -
CVE-2026-61976
WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitiv -
CVE-2025-49934
WordPress JetBlocks For Elementor plugin <= 1.3.18 - Cross S -
CVE-2025-53988
WordPress JetBlocks For Elementor <= 1.3.18 - Sensitive Data -
CVE-2025-53989
WordPress JetBlocks For Elementor plugin <= 1.3.19 - Cross S
Same vendor: Crocoblock
-
CVE-2026-94667
WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting -
CVE-2026-94661
WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (X -
CVE-2026-105879
WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cros -
CVE-2026-93875
JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Sit -
CVE-2026-84817
WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scri
Same weakness: CWE-79
-
CVE-2026-62039
WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Sc -
CVE-2026-94161
WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross -
CVE-2026-94158
WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross -
CVE-2026-94159
WordPress Total Donations plugin <= 2.0.5 - Cross Site Scrip -
CVE-2026-94167
WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site
V. Comments for CVE-2026-62049
No comments yet