Cross-Site Scripting Vulnerability in CrocoBlock JetBlocks for Elementor

CVE-2025-49934

What is CVE-2025-49934?

A cross-site scripting (XSS) vulnerability exists in CrocoBlock's JetBlocks for Elementor, allowing attackers to inject malicious scripts. This security flaw impacts versions up to 1.3.18 of the plugin, potentially compromising the integrity of affected web applications. It enables stored XSS, where harmful scripts can be executed in users' browsers, resulting in session hijacking or data theft. Site owners using vulnerable versions are urged to update promptly to safeguard their websites against such attacks.

References