The vulnerability results from improper neutralization of input during web page generation in the JetEngine plugin, allowing attackers to inject script code into pages that is then executed by users’ browsers. This reflected XSS can lead to session hijacking, cookie theft, defacement, or delivery of malware, depending on the attacker’s goals, and poses a full confidentiality, integrity, and availability risk for site visitors.

Crocoblock JetEngine plugin versions up to and including 3.8.0 on WordPress installations are affected. Sites that have not upgraded beyond this version are vulnerable.

With a CVSS score of 7.1 the severity is moderate‑high, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers can likely exploit the flaw by embedding malicious script in parameters that are echoed by the plugin, such as query strings or form inputs, without needing authentication. Because the reflected payload is executed in the context of the target user’s browser, the impact can affect any visitor who loads the vulnerable page.