The Crocoblock JetBlocks for Elementor plugin is vulnerable to a stored XSS flaw caused by improper neutralization of input during web page generation. When an attacker inserts malicious scripts into content fields that are processed and stored by the plugin, those scripts become part of the page output. Any visitor who loads a page that incorporates JetBlocks may then have the injected code executed within their browser context.

WordPress sites that have the JetBlocks for Elementor plugin installed at version 1.3.18 or earlier are affected. The vulnerability spans all releases from the first available version up to and including 1.3.18.

The CVSS score of 6.5 classifies this as a medium‑severity issue, while the EPSS score of less than 1 % indicates that widespread exploitation has not yet been observed. The flaw is not listed in the CISA KEV catalog, so there is currently no coordinated exploitation activity reported. The likely attack vector is through any input channel the plugin exposes to users with sufficient permissions, such as administrators or content editors, based on the description that vulnerable content is stored and renders in pages. Attackers who can inject such content can cause stored XSS that will execute for any visitor who views a page containing the injected code.