# CVE-2026-94661: Crocoblock JetBlog reflected cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-94661-improper-neutralization-of-input-during-web-page-generation-cross  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-94661 · Severity: high · CVSS 7.1 · Published 2026-10-09

JetBlog is a WordPress plugin for creating dynamic blog content and pages. A reflected cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts that execute in visitors' browsers, potentially stealing session data or hijacking user accounts when victims click a crafted link.

Technologies: [Crocoblock JetBlog](https://junglewise.ai/threats/technologies/jetblog). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-94661 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94661 being exploited in the wild.

**How severe is CVE-2026-94661?** High severity, with a CVSS score of 7.1, published 9 October 2026.

**Which products and versions are affected?** Crocoblock JetBlog through 2.4.10.

**Is there a fix for CVE-2026-94661?** Yes: fixed in 2.4.10.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94661 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-94661?** Check whether you run Crocoblock JetBlog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.4.10.1

## Technical details

The plugin fails to properly sanitize user input during web page generation, allowing reflected XSS attacks via unprotected parameters. No authentication is required to craft a malicious link, but user interaction (clicking the link) is necessary for exploitation. An attacker can steal visitor cookies, session tokens, or perform actions on behalf of logged-in users.

## Affected products

- Crocoblock JetBlog through 2.4.10

## Timeline

- 2026-10-09: disclosed
- 2026-10-03: advisory: Patchstack advisory published

## References

- [https://crocoblock.com/](https://crocoblock.com/)
- [https://patchstack.com/database/wordpress/plugin/jet-blog/vulnerability/wordpress-jetblog-plugin-2-4-10-cross-site-scripting-xss-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/jet-blog/vulnerability/wordpress-jetblog-plugin-2-4-10-cross-site-scripting-xss-vulnerability-2?_s_id=cve)

## Related threats

- [Crocoblock JetBlog cross-site scripting in contributor form](https://junglewise.ai/threats/cve-2026-66572-crocoblock-jetblog-cross-site-scripting-in-contributor-form)
- [Jetimpex JetBlog sensitive data exposure in WordPress plugin](https://junglewise.ai/threats/cve-2026-52696-jetimpex-jetblog-sensitive-data-exposure-in-wordpress-plugin)