Sensitive information is improperly inserted into data transmitted by Crocoblock JetBlocks For Elementor, allowing an attacker to retrieve embedded sensitive data such as credentials, API keys, or internal configuration values. The weakness is classified as CWE-201, which permits unauthorized disclosure of confidential information, compromising the confidentiality of stored or transmitted data and potentially enabling credential theft or further exploitation of the WordPress instance.

The vulnerability affects the Crocoblock JetBlocks For Elementor plugin for WordPress versions up to and including 1.3.18. Any WordPress site that has this plugin installed and enabled is at risk; sites running a newer release are not affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of <1% suggests the likelihood of exploitation is very low at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be an attacker who can interact with the plugin’s data export or exchange features, and the plugin must be active for the flaw to be utilized. Despite the low exploitation probability, the confidentiality impact warrants prompt remediation.