The vulnerability is a DOM‑based Cross‑Site Scripting flaw in the Crocoblock JetEngine WordPress plugin. An attacker can embed malicious JavaScript that runs in the victim’s browser when the affected page is loaded. This weakness is an Improper Neutralization of Input During Web Page Generation, identified as CWE‑79.

Crocoblock JetEngine plugin versions up to and including 3.8.16 are affected. All installations that have not upgraded beyond 3.8.16 allow the flaw to be triggered through the plugin’s user interface on any WordPress site using that version.

The CVSS base score of 7.1 indicates a moderate to high potential impact. Because the EPSS score is 0.00251, the probability of exploitation is very low, and the lack of a KEV listing shows the flaw has not yet become a widely known high‑profile target. The likely attack vector is a DOM‑based XSS that can be triggered by supplying malicious input in the plugin’s UI; the attacker does not need to compromise the server or modify files, only needs to cause a user to load a crafted payload.