Improper Neutralization of Input During Web Page Generation (CWE‑79) in the Crocoblock JetEngine WordPress plugin permits the injection of arbitrary script when unsanitized user input is rendered. This DOM‑based XSS causes the injected code to run in the victim’s browser. Based on the nature of XSS, the attacker could potentially steal cookies, hijack sessions, or perform actions as the user; this is inferred from typical XSS impact and is not explicitly stated in the CVE description. The vulnerability affects only client‑side code, so it does not grant remote code execution on the server.

The flaw affects all installations of the JetEngine plugin version 3.6.4.1 and earlier. It does not impact other Crocoblock products or later plugin releases. Systems running WordPress sites with this plugin exposed to the network should be assessed for the vulnerable version.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue. Attackers would need to deliver a crafted request that includes the unsanitized input, typically via a user‑sourced field or URL parameter. While this could be done remotely, the requirement for user interaction is inferred from the DOM‑based nature and is not explicitly stated.