Crocoblock JetSearch plugin allows reflected XSS due to improper neutralization of input during web page generation. This flaw can enable an attacker to inject malicious scripts that execute in the context of a victim’s browser, compromising confidentiality, integrity, or availability of user data. The weakness is classified as CWE‑79, a classic script injection issue that can directly affect user sessions or distract users into providing credentials.

Affecting all installations of Crocoblock JetSearch up to and including version 3.5.10. Administrators should verify the exact version deployed; any installation at or below 3.5.10 is vulnerable.

The CVSS score of 7.1 indicates a high severity exploit. EPSS is below 1 %, implying the probability of widespread exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via a reflected XSS payload injected through the plugin’s search input or URL parameters, which can be triggered by an unauthenticated user or via a crafted link. Without mitigation, attackers could hijack user sessions, deface the site, or deliver malware.