{"schema_version":1,"title":"Crocoblock vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 46 vulnerabilities in Crocoblock: 2 in the last 7 days and 28 in the last 90 days, 12 of them critical and 0 exploited in the wild. The most recent, CVE-2026-92212, was published on 25 September 2026. 4 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/crocoblock","json_url":"https://junglewise.ai/threats/vendors/crocoblock.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/crocoblock","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":10,"all_time":46,"critical":12,"exploited":0,"last_7_days":2,"last_30_days":17,"last_90_days":28,"last_365_days":46},"latest":[{"cve":"CVE-2026-92212","cvss":6.1,"epss":0.0022,"slug":"cve-2026-92212-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for","title":"JetFormBuilder reflected XSS via URL query variable in calculated field","severity":"medium","exploited":false,"published_at":"2026-09-25T07:16:55.337+00:00","url":"https://junglewise.ai/threats/cve-2026-92212-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for"},{"cve":"CVE-2022-4997","cvss":8.6,"epss":0.0027,"slug":"cve-2022-4997-the-jet-form-builder-stripe-gateway-wordpress-plugin-before-1-1-0","title":"JetFormBuilder Stripe Gateway SQL injection in payment token","severity":"high","exploited":false,"published_at":"2026-09-23T06:16:59.06+00:00","url":"https://junglewise.ai/threats/cve-2022-4997-the-jet-form-builder-stripe-gateway-wordpress-plugin-before-1-1-0"},{"cve":"CVE-2026-19860","cvss":5.5,"epss":0.0023,"slug":"cve-2026-19860-the-jetformbuilder-dynamic-blocks-form-builder-wordpress-plugin","title":"JetFormBuilder arbitrary file deletion via validation callback","severity":"medium","exploited":false,"published_at":"2026-09-19T07:16:32.417+00:00","url":"https://junglewise.ai/threats/cve-2026-19860-the-jetformbuilder-dynamic-blocks-form-builder-wordpress-plugin"},{"cve":"CVE-2026-66579","cvss":6.5,"epss":0.0022,"slug":"cve-2026-66579-jetelements-for-elementor-contributor-xss","title":"JetElements for Elementor Contributor XSS","severity":"medium","exploited":false,"published_at":"2026-09-17T14:17:16.653+00:00","url":"https://junglewise.ai/threats/cve-2026-66579-jetelements-for-elementor-contributor-xss"},{"cve":"CVE-2026-66577","cvss":6.5,"epss":0.0022,"slug":"cve-2026-66577-crocoblock-jetsearch-cross-site-scripting-in-contributor-panel","title":"Crocoblock JetSearch cross-site scripting in contributor panel","severity":"medium","exploited":false,"published_at":"2026-09-17T14:17:16.34+00:00","url":"https://junglewise.ai/threats/cve-2026-66577-crocoblock-jetsearch-cross-site-scripting-in-contributor-panel"},{"cve":"CVE-2026-66576","cvss":6.5,"epss":0.0022,"slug":"cve-2026-66576-crocoblock-jetblocks-for-elementor-contributor-xss","title":"Crocoblock JetBlocks For Elementor contributor XSS","severity":"medium","exploited":false,"published_at":"2026-09-17T14:17:16.213+00:00","url":"https://junglewise.ai/threats/cve-2026-66576-crocoblock-jetblocks-for-elementor-contributor-xss"},{"cve":"CVE-2026-66573","cvss":6.5,"epss":0.0022,"slug":"cve-2026-66573-jettabs-contributor-cross-site-scripting-xss","title":"JetTabs Contributor Cross Site Scripting (XSS)","severity":"medium","exploited":false,"published_at":"2026-09-17T14:17:15.813+00:00","url":"https://junglewise.ai/threats/cve-2026-66573-jettabs-contributor-cross-site-scripting-xss"},{"cve":"CVE-2026-66572","cvss":6.5,"epss":0.0022,"slug":"cve-2026-66572-crocoblock-jetblog-cross-site-scripting-in-contributor-form","title":"Crocoblock JetBlog cross-site scripting in contributor form","severity":"medium","exploited":false,"published_at":"2026-09-17T14:17:15.68+00:00","url":"https://junglewise.ai/threats/cve-2026-66572-crocoblock-jetblog-cross-site-scripting-in-contributor-form"},{"cve":"CVE-2026-12793","cvss":9.8,"epss":0.0052,"slug":"cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing","title":"JetFormBuilder privilege escalation in form schema parsing","severity":"critical","exploited":false,"published_at":"2026-09-16T04:17:56.11+00:00","url":"https://junglewise.ai/threats/cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing"},{"cve":"CVE-2026-84817","cvss":7.1,"epss":0.0025,"slug":"cve-2026-84817-jetformbuilder-unauthenticated-cross-site-scripting-xss","title":"JetFormBuilder unauthenticated cross-site scripting (XSS)","severity":"high","exploited":false,"published_at":"2026-09-08T08:17:13.393+00:00","url":"https://junglewise.ai/threats/cve-2026-84817-jetformbuilder-unauthenticated-cross-site-scripting-xss"},{"cve":"CVE-2026-19862","cvss":4.8,"epss":0.0015,"slug":"cve-2026-19862-jetformbuilder-email-header-injection-in-send-email-action","title":"JetFormBuilder email header injection in Send Email action","severity":"medium","exploited":false,"published_at":"2026-09-06T10:17:14.563+00:00","url":"https://junglewise.ai/threats/cve-2026-19862-jetformbuilder-email-header-injection-in-send-email-action"},{"cve":"CVE-2026-19859","cvss":6.5,"epss":0.002,"slug":"cve-2026-19859-jetformbuilder-arbitrary-shortcode-execution-via-status-parameter","title":"JetFormBuilder arbitrary shortcode execution via status parameter","severity":"medium","exploited":false,"published_at":"2026-09-06T10:17:13.577+00:00","url":"https://junglewise.ai/threats/cve-2026-19859-jetformbuilder-arbitrary-shortcode-execution-via-status-parameter"},{"cve":"CVE-2026-19861","cvss":4.7,"epss":0.0017,"slug":"cve-2026-19861-jetformbuilder-wordpress-plugin-html-injection-in-notification","title":"JetFormBuilder WordPress plugin HTML injection in notification emails","severity":"medium","exploited":false,"published_at":"2026-09-05T07:17:11.563+00:00","url":"https://junglewise.ai/threats/cve-2026-19861-jetformbuilder-wordpress-plugin-html-injection-in-notification"},{"cve":"CVE-2026-19858","cvss":7.5,"epss":0.0032,"slug":"cve-2026-19858-jetformbuilder-authorization-bypass-in-request-resolution","title":"JetFormBuilder authorization bypass in request resolution","severity":"high","exploited":false,"published_at":"2026-09-05T07:17:11.467+00:00","url":"https://junglewise.ai/threats/cve-2026-19858-jetformbuilder-authorization-bypass-in-request-resolution"},{"cve":"CVE-2026-27347","cvss":5.3,"epss":0.0031,"slug":"cve-2026-27347-crocoblock-jetpopup-broken-access-control-in-popup-configuration","title":"Crocoblock JetPopup broken access control in popup configuration","severity":"medium","exploited":false,"published_at":"2026-09-04T11:17:18.053+00:00","url":"https://junglewise.ai/threats/cve-2026-27347-crocoblock-jetpopup-broken-access-control-in-popup-configuration"},{"cve":"CVE-2026-81432","cvss":4.3,"epss":0.0017,"slug":"cve-2026-81432-jetstylemanager-for-gutenberg-csrf-via-unprotected-ajax-actions","title":"JetStyleManager for Gutenberg CSRF via unprotected AJAX actions","severity":"medium","exploited":false,"published_at":"2026-09-02T06:17:19.473+00:00","url":"https://junglewise.ai/threats/cve-2026-81432-jetstylemanager-for-gutenberg-csrf-via-unprotected-ajax-actions"},{"cve":"CVE-2026-81760","cvss":7.1,"epss":0.0025,"slug":"cve-2026-81760-crocoblock-jetengine-reflected-cross-site-scripting-xss","title":"Crocoblock JetEngine reflected cross-site scripting (XSS)","severity":"high","exploited":false,"published_at":"2026-08-28T16:18:30.34+00:00","url":"https://junglewise.ai/threats/cve-2026-81760-crocoblock-jetengine-reflected-cross-site-scripting-xss"},{"cve":"CVE-2026-17019","cvss":6.1,"epss":0.0028,"slug":"cve-2026-17019-jetengine-stored-cross-site-scripting-via-svg-file-upload","title":"JetEngine stored cross-site scripting via SVG file upload","severity":"medium","exploited":false,"published_at":"2026-08-10T07:16:48.927+00:00","url":"https://junglewise.ai/threats/cve-2026-17019-jetengine-stored-cross-site-scripting-via-svg-file-upload"},{"cve":"CVE-2026-14864","cvss":5.4,"epss":0.0023,"slug":"cve-2026-14864-crocoblock-jetengine-stored-xss-via-unescaped-shortcode-meta","title":"Crocoblock JetEngine stored XSS via unescaped shortcode meta output","severity":"medium","exploited":false,"published_at":"2026-08-02T06:16:35.37+00:00","url":"https://junglewise.ai/threats/cve-2026-14864-crocoblock-jetengine-stored-xss-via-unescaped-shortcode-meta"},{"cve":"CVE-2026-65468","cvss":5.3,"slug":"cve-2026-65468-crocoblock-jetbooking-broken-access-control","title":"Crocoblock JetBooking broken access control","severity":"medium","exploited":false,"published_at":"2026-07-23T12:18:39.47+00:00","url":"https://junglewise.ai/threats/cve-2026-65468-crocoblock-jetbooking-broken-access-control"},{"cve":"CVE-2026-65467","cvss":4.9,"slug":"cve-2026-65467-crocoblock-jetengine-ssrf-in-wordpress-plugin","title":"Crocoblock JetEngine SSRF in WordPress plugin","severity":"medium","exploited":false,"published_at":"2026-07-23T12:18:39.347+00:00","url":"https://junglewise.ai/threats/cve-2026-65467-crocoblock-jetengine-ssrf-in-wordpress-plugin"},{"cve":"CVE-2026-65466","cvss":4.9,"slug":"cve-2026-65466-crocoblock-jetbooking-ssrf-via-custom-role","title":"Crocoblock JetBooking SSRF via Custom Role","severity":"medium","exploited":false,"published_at":"2026-07-23T12:18:39.22+00:00","url":"https://junglewise.ai/threats/cve-2026-65466-crocoblock-jetbooking-ssrf-via-custom-role"},{"cve":"CVE-2026-65465","cvss":6.5,"slug":"cve-2026-65465-crocoblock-jetelements-for-elementor-xss-in-wordpress-plugin","title":"Crocoblock JetElements For Elementor XSS in WordPress plugin","severity":"medium","exploited":false,"published_at":"2026-07-23T12:18:39.09+00:00","url":"https://junglewise.ai/threats/cve-2026-65465-crocoblock-jetelements-for-elementor-xss-in-wordpress-plugin"},{"cve":"CVE-2026-61977","cvss":5.3,"slug":"cve-2026-61977-crocoblock-jetsearch-sensitive-information-disclosure-in-jet","title":"Crocoblock JetSearch sensitive information disclosure in jet-search","severity":"medium","exploited":false,"published_at":"2026-07-13T10:16:47.4+00:00","url":"https://junglewise.ai/threats/cve-2026-61977-crocoblock-jetsearch-sensitive-information-disclosure-in-jet"},{"cve":"CVE-2026-61976","cvss":5.3,"slug":"cve-2026-61976-crocoblock-jetblocks-for-elementor-sensitive-information-exposure","title":"Crocoblock JetBlocks For Elementor sensitive information exposure","severity":"medium","exploited":false,"published_at":"2026-07-13T10:16:47.28+00:00","url":"https://junglewise.ai/threats/cve-2026-61976-crocoblock-jetblocks-for-elementor-sensitive-information-exposure"}],"vendor":{"hub":true,"name":"Crocoblock","slug":"crocoblock","homepage":"https://crocoblock.com/","description":"A developer of plugins and tools for the WordPress ecosystem and Elementor page builder.","url":"https://junglewise.ai/threats/vendors/crocoblock"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":1,"exploited":0,"vulnerabilities":7},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":2}],"most_severe":[{"cve":"CVE-2026-12793","cvss":9.8,"epss":0.0052,"slug":"cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing","title":"JetFormBuilder privilege escalation in form schema parsing","severity":"critical","exploited":false,"published_at":"2026-09-16T04:17:56.11+00:00","url":"https://junglewise.ai/threats/cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing"},{"cve":"CVE-2026-52706","cvss":9.8,"epss":0.0039,"slug":"cve-2026-52706-jetimpex-jetengine-php-object-injection","title":"Jetimpex JetEngine PHP Object Injection","severity":"critical","exploited":false,"published_at":"2026-06-17T13:20:49.313+00:00","url":"https://junglewise.ai/threats/cve-2026-52706-jetimpex-jetengine-php-object-injection"},{"cve":"CVE-2026-49075","cvss":9.8,"slug":"cve-2026-49075-jetimpex-jetengine-php-object-injection","title":"Jetimpex JetEngine PHP Object Injection","severity":"critical","exploited":false,"published_at":"2026-06-17T13:20:45.66+00:00","url":"https://junglewise.ai/threats/cve-2026-49075-jetimpex-jetengine-php-object-injection"},{"cve":"CVE-2026-54187","cvss":9.3,"epss":0.0029,"slug":"cve-2026-54187-jetimpex-jetengine-unauthenticated-sql-injection","title":"Jetimpex JetEngine unauthenticated SQL injection","severity":"critical","exploited":false,"published_at":"2026-06-17T13:20:50.147+00:00","url":"https://junglewise.ai/threats/cve-2026-54187-jetimpex-jetengine-unauthenticated-sql-injection"},{"cve":"CVE-2026-49084","cvss":9.3,"epss":0.0029,"slug":"cve-2026-49084-jetimpex-jetengine-unauthenticated-sql-injection","title":"Jetimpex JetEngine unauthenticated SQL injection","severity":"critical","exploited":false,"published_at":"2026-06-17T13:20:46.323+00:00","url":"https://junglewise.ai/threats/cve-2026-49084-jetimpex-jetengine-unauthenticated-sql-injection"},{"cve":"CVE-2026-42774","cvss":9.3,"epss":0.0003,"slug":"cve-2026-42774-crocoblock-jetengine-sql-injection","title":"Crocoblock JetEngine SQL injection","severity":"critical","exploited":false,"published_at":"2026-05-25T23:16:33.073+00:00","url":"https://junglewise.ai/threats/cve-2026-42774-crocoblock-jetengine-sql-injection"},{"cve":"CVE-2026-56068","cvss":9.3,"slug":"cve-2026-56068-crocoblock-jetengine-unauthenticated-sql-injection","title":"Crocoblock JetEngine unauthenticated SQL injection","severity":"critical","exploited":false,"published_at":"2026-06-26T15:16:46.62+00:00","url":"https://junglewise.ai/threats/cve-2026-56068-crocoblock-jetengine-unauthenticated-sql-injection"},{"cve":"CVE-2026-56067","cvss":9.3,"slug":"cve-2026-56067-crocoblock-jetsmartfilters-unauthenticated-sql-injection","title":"Crocoblock JetSmartFilters unauthenticated SQL injection","severity":"critical","exploited":false,"published_at":"2026-06-26T15:16:46.26+00:00","url":"https://junglewise.ai/threats/cve-2026-56067-crocoblock-jetsmartfilters-unauthenticated-sql-injection"},{"cve":"CVE-2026-54820","cvss":9.3,"slug":"cve-2026-54820-crocoblock-jetbooking-unauthenticated-sql-injection","title":"Crocoblock JetBooking unauthenticated SQL injection","severity":"critical","exploited":false,"published_at":"2026-06-26T15:16:39.977+00:00","url":"https://junglewise.ai/threats/cve-2026-54820-crocoblock-jetbooking-unauthenticated-sql-injection"},{"cve":"CVE-2026-49079","cvss":9.3,"slug":"cve-2026-49079-jetimpex-jetsearch-sql-injection-in-wordpress-plugin","title":"Jetimpex JetSearch SQL injection in WordPress plugin","severity":"critical","exploited":false,"published_at":"2026-06-17T13:20:45.917+00:00","url":"https://junglewise.ai/threats/cve-2026-49079-jetimpex-jetsearch-sql-injection-in-wordpress-plugin"}],"generated_at":"2026-09-26T12:07:00.15149+00:00","technologies":[{"name":"Crocoblock JetEngine","slug":"jetengine","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/jetengine"},{"name":"Crocoblock JetFormBuilder","slug":"jetformbuilder","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/jetformbuilder"},{"name":"Crocoblock JetBooking","slug":"jetbooking","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/jetbooking"},{"name":"Crocoblock JetSearch","slug":"jetsearch","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/jetsearch"}]}