Executive brief
JetSearch is a WordPress search plugin developed by Crocoblock. A cross-site scripting (XSS) vulnerability allows a contributor-level user to inject malicious code into the site, potentially stealing visitor data or hijacking user accounts. The vulnerability requires user interaction, such as a visitor clicking a malicious link or opening a crafted page.
Technical details
The vulnerability is a stored or reflected cross-site scripting (XSS) flaw in the JetSearch plugin for WordPress affecting versions 3.6.3 and earlier. The attack vector requires contributor-level privileges to initiate, and successful exploitation depends on user interaction (e.g., a visitor clicking a malicious link). An attacker with contributor access can inject malicious JavaScript that executes in visitors' browsers, potentially compromising session cookies, stealing credentials, or performing actions on behalf of affected users. The vulnerability was patched in version 3.6.3.1.
Affected products
- Crocoblock JetSearch <= 3.6.3
Timeline
- 2026-09-17: disclosed: Published by Patchstack