Cross-site Scripting Flaw in CrocoBlock JetEngine Plugin
CVE-2025-49938

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Jetengine
Vendor
CVE Published:
22 October 2025

What is CVE-2025-49938?

The CrocoBlock JetEngine plugin is susceptible to a serious Cross-site Scripting (XSS) vulnerability, allowing an attacker to inject malicious scripts that are stored on the server. This flaw affects versions of JetEngine up to and including 3.7.3, potentially compromising the security of WordPress sites using this plugin by executing unauthorized scripts in the browsers of users who access the compromised site.

Affected Version(s)

JetEngine <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/jet-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

stealthcopter (Patchstack Alliance)
JSON
.