# CVE-2026-66577: Crocoblock JetSearch cross-site scripting in contributor panel

Source: https://junglewise.ai/threats/cve-2026-66577-crocoblock-jetsearch-cross-site-scripting-in-contributor-panel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-66577 · Severity: medium · CVSS 6.5 · Published 2026-09-17

JetSearch is a WordPress search plugin developed by Crocoblock. A cross-site scripting (XSS) vulnerability allows a contributor-level user to inject malicious code into the site, potentially stealing visitor data or hijacking user accounts. The vulnerability requires user interaction, such as a visitor clicking a malicious link or opening a crafted page.

Technologies: [Crocoblock JetSearch](https://junglewise.ai/threats/technologies/jetsearch). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-66577 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66577 being exploited in the wild.

**How severe is CVE-2026-66577?** Medium severity, with a CVSS score of 6.5, published 17 September 2026.

**Which products and versions are affected?** Crocoblock JetSearch <= 3.6.3.

**Is there a fix for CVE-2026-66577?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66577 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66577?** Check whether you run Crocoblock JetSearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored or reflected cross-site scripting (XSS) flaw in the JetSearch plugin for WordPress affecting versions 3.6.3 and earlier. The attack vector requires contributor-level privileges to initiate, and successful exploitation depends on user interaction (e.g., a visitor clicking a malicious link). An attacker with contributor access can inject malicious JavaScript that executes in visitors' browsers, potentially compromising session cookies, stealing credentials, or performing actions on behalf of affected users. The vulnerability was patched in version 3.6.3.1.

## Affected products

- Crocoblock JetSearch <= 3.6.3

## Timeline

- 2026-09-17: disclosed: Published by Patchstack

## References

- [https://patchstack.com/database/wordpress/plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [Crocoblock JetSearch sensitive information disclosure in jet-search](https://junglewise.ai/threats/cve-2026-61977-crocoblock-jetsearch-sensitive-information-disclosure-in-jet)
- [Jetimpex JetSearch SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-49079-jetimpex-jetsearch-sql-injection-in-wordpress-plugin)