The flaw is an improper neutralization of user input during page generation, allowing a stored cross‑site scripting payload to be embedded by an authenticated user with editing privileges. When a legitimate visitor loads the affected page, the embedded script runs in the visitor's browser, potentially hijacking sessions, modifying page content, or exfiltrating data.

Crocoblock JetBlocks For Elementor plugin versions up to and including 1.5.2.1 are affected. Any WordPress site that has this plugin installed at a vulnerable version is at risk.

The CVSS score of 6.5 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploit yet. However, the stored XSS requires the attacker to have sufficient privileges to inject content through the plugin’s interface, after which all site visitors who view the compromised page are affected. This makes the risk significant enough to warrant immediate remediation.