Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 92

Export CSV
CVE-2023-48758

WordPress JetEngine plugin <= 3.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.2.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetengine Wordpress
CVE-2023-48763

WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.1.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetformbuilder Wordpress
CVE-2023-48762

WordPress JetElements For Elementor Plugin <= 2.6.13 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock
Products
Jetelements For Elementor
CVE-2023-48761

WordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock
Products
Jetelements
CVE-2023-39157

WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Crocoblock
Products
Jetelements
CVE-2026-4662

JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the `prepare_where_clause()` method in the SQL Query Builder not sanitizing the `compare` operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetengine Wordpress
CVE-2025-69333

WordPress JetEngine plugin <= 3.8.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetengine Wordpress
CVE-2025-68499

WordPress JetTabs plugin <= 2.2.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.12.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jettabs Wordpress
CVE-2025-68498

WordPress JetTabs plugin <= 2.2.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jettabs Wordpress
CVE-2025-64355

WordPress JetElements For Elementor plugin <= 2.7.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.12.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetelements For Elementor Wordpress
CVE-2025-55714

WordPress JetElements For Elementor Plugin <= 2.7.9 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetelements For Elementor Wordpress
CVE-2025-54749

WordPress JetProductGallery Plugin <= 2.2.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allows Stored XSS.This issue affects JetProductGallery: from n/a through <= 2.2.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetproductgallery Wordpress
CVE-2025-54688

WordPress JetEngine Plugin plugin <= 3.7.1.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.1.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetengine Wordpress
CVE-2025-54687

WordPress JetTabs Plugin plugin <= 2.2.9.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.9.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jettabs Wordpress
CVE-2025-53195

WordPress JetEngine plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetengine Wordpress
CVE-2025-53194

WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability

Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetengine Wordpress
CVE-2025-49934

WordPress JetBlocks For Elementor plugin <= 1.3.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Elementor Wordpress
Products
Jettabs For Elementor Elementor Wordpress
CVE-2025-39448

WordPress JetElements For Elementor plugin <= 2.7.4.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock
Products
Jetelements For Elementor
CVE-2026-32355

WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetengine Wordpress
CVE-2026-28134

WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetengine Wordpress