# Crocoblock vulnerabilities Source: https://junglewise.ai/threats/vendors/crocoblock Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/crocoblock.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 83 vulnerabilities in Crocoblock: 9 in the last 7 days and 54 in the last 90 days, 13 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125785, was published on 12 November 2026. 23 vulnerabilities in the last four weeks, up 15% on the four before (20). 1 critical against 1. 9 technologies have a page of their own. ## Counts - Last 7 days: 9 - Last 30 days: 24 - Last 90 days: 54 - All time: 83 (13 critical, 0 exploited in the wild) ## About Crocoblock A developer of plugins and tools for the WordPress ecosystem and Elementor page builder. ## Latest Crocoblock vulnerabilities - [CVE-2026-125785: Crocoblock JetEngine stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125785-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 12 Nov 2026) - [CVE-2026-123482: Crocoblock JetFormBuilder stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123482-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-123484: Crocoblock JetFormBuilder cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-123484-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-123861: CrocoBlock JetFormBuilder Hierarchical Select insecure direct object reference](https://junglewise.ai/threats/cve-2026-123861-authorization-bypass-through-user-controlled-key-vulnerability) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-123860: Crocoblock JetFormBuilder content injection in form pages](https://junglewise.ai/threats/cve-2026-123860-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-123483: Crocoblock JetFormBuilder stored XSS in form fields](https://junglewise.ai/threats/cve-2026-123483-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-123477: Crocoblock JetEngine stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123477-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 7 Nov 2026) - [CVE-2026-121977: JetFormBuilder Dynamic Blocks Form Builder stored XSS in form field note](https://junglewise.ai/threats/cve-2026-121977-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (medium, CVSS 5.4, published 7 Nov 2026) - [CVE-2026-119183: JetFormBuilder Stored Cross-Site Scripting via form field mapping](https://junglewise.ai/threats/cve-2026-119183-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (high, CVSS 7.2, published 7 Nov 2026) - [CVE-2026-119481: Crocoblock JetFormBuilder privilege escalation](https://junglewise.ai/threats/cve-2026-119481-incorrect-privilege-assignment-vulnerability-in-crocoblock) (critical, CVSS 9.8, published 4 Nov 2026) - [CVE-2026-120561: JetFormBuilder missing capability check in Update Options](https://junglewise.ai/threats/cve-2026-120561-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-119480: Crocoblock JetFormBuilder path traversal arbitrary file deletion](https://junglewise.ai/threats/cve-2026-119480-improper-limitation-of-a-pathname-to-a-restricted-directory-path) (medium, CVSS 6.5, published 1 Nov 2026) - [CVE-2026-119176: CP Multi View Events Calendar stored cross-site scripting](https://junglewise.ai/threats/cve-2026-119176-the-cp-multi-view-events-calendar-plugin-for-wordpress-is) (medium, CVSS 6.4, published 30 Oct 2026) - [CVE-2026-119479: Crocoblock JetFormBuilder XSS in form input handling](https://junglewise.ai/threats/cve-2026-119479-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 5.3, published 30 Oct 2026) - [CVE-2026-119482: Crocoblock JetFormBuilder broken access control vulnerability](https://junglewise.ai/threats/cve-2026-119482-missing-authorization-vulnerability-in-crocoblock-jetformbuilder) (medium, CVSS 5.3, published 30 Oct 2026) - [CVE-2026-39737: Crocoblock JetElements For Elementor stored XSS](https://junglewise.ai/threats/cve-2026-39737-improper-neutralization-of-input-during-web-page-generation-cross) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-39736: Crocoblock JetEngine SQL injection](https://junglewise.ai/threats/cve-2026-39736-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 8.5, published 29 Oct 2026) - [CVE-2026-116857: Crocoblock JetSmartFilters stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116857-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-39735: Crocoblock JetEngine broken access control](https://junglewise.ai/threats/cve-2026-39735-missing-authorization-vulnerability-in-crocoblock-jetengine-jet) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-115608: Crocoblock JetEngine SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-115608-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 8.5, published 26 Oct 2026) - [CVE-2026-114708: Crocoblock JetSmartFilters stored cross-site scripting](https://junglewise.ai/threats/cve-2026-114708-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-114707: Crocoblock JetElements For Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-114707-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-111414: Crocoblock JetElements For Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-111414-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-107870: Crocoblock JetEngine DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2026-107870-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 14 Oct 2026) - [CVE-2026-107866: Crocoblock JetElements for Elementor stored XSS](https://junglewise.ai/threats/cve-2026-107866-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 12 Oct 2026) ## Most severe Crocoblock vulnerabilities - [CVE-2026-12793: JetFormBuilder privilege escalation in form schema parsing](https://junglewise.ai/threats/cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing) (critical, CVSS 9.8, published 16 Sep 2026) - [CVE-2026-52706: Jetimpex JetEngine PHP Object Injection](https://junglewise.ai/threats/cve-2026-52706-jetimpex-jetengine-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2026-119481: Crocoblock JetFormBuilder privilege escalation](https://junglewise.ai/threats/cve-2026-119481-incorrect-privilege-assignment-vulnerability-in-crocoblock) (critical, CVSS 9.8, published 4 Nov 2026) - [CVE-2026-49075: Jetimpex JetEngine PHP Object Injection](https://junglewise.ai/threats/cve-2026-49075-jetimpex-jetengine-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2026-54187: Jetimpex JetEngine unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-54187-jetimpex-jetengine-unauthenticated-sql-injection) (critical, CVSS 9.3, published 17 Jun 2026) - [CVE-2026-49084: Jetimpex JetEngine unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-49084-jetimpex-jetengine-unauthenticated-sql-injection) (critical, CVSS 9.3, published 17 Jun 2026) - [CVE-2026-42774: Crocoblock JetEngine SQL injection](https://junglewise.ai/threats/cve-2026-42774-crocoblock-jetengine-sql-injection) (critical, CVSS 9.3, published 25 May 2026) - [CVE-2026-56068: Crocoblock JetEngine unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-56068-crocoblock-jetengine-unauthenticated-sql-injection) (critical, CVSS 9.3, published 26 Jun 2026) - [CVE-2026-56067: Crocoblock JetSmartFilters unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-56067-crocoblock-jetsmartfilters-unauthenticated-sql-injection) (critical, CVSS 9.3, published 26 Jun 2026) - [CVE-2026-54820: Crocoblock JetBooking unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-54820-crocoblock-jetbooking-unauthenticated-sql-injection) (critical, CVSS 9.3, published 26 Jun 2026) ## Vulnerabilities per week 23 vulnerabilities in the last four weeks, up 15% on the four before (20). 1 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 6 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 7 | 1 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 6 | 0 | 0 | | 5 Oct 2026 | 5 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 11 | 0 | 0 | | 2 Nov 2026 | 8 | 1 | 0 | | 9 Nov 2026 | 3 | 0 | 0 | ## Crocoblock technologies - [Crocoblock JetEngine](https://junglewise.ai/threats/technologies/jetengine): 24 vulnerabilities - [Crocoblock JetFormBuilder](https://junglewise.ai/threats/technologies/jetformbuilder): 24 vulnerabilities - [Crocoblock JetElements For Elementor](https://junglewise.ai/threats/technologies/jetelements-for-elementor): 7 vulnerabilities - [Crocoblock JetSmartFilters](https://junglewise.ai/threats/technologies/jetsmartfilters): 4 vulnerabilities - [Crocoblock JetBlocks For Elementor](https://junglewise.ai/threats/technologies/jetblocks-for-elementor): 3 vulnerabilities - [Crocoblock JetBlog](https://junglewise.ai/threats/technologies/jetblog): 3 vulnerabilities - [Crocoblock JetBooking](https://junglewise.ai/threats/technologies/jetbooking): 3 vulnerabilities - [Crocoblock JetReviews](https://junglewise.ai/threats/technologies/jetreviews): 3 vulnerabilities - [Crocoblock JetSearch](https://junglewise.ai/threats/technologies/jetsearch): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Crocoblock vulnerabilities", https://junglewise.ai/threats/vendors/crocoblock, 12 November 2026.