Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

JetBlog plugin can let attackers inject malicious code

CVE-2026-94661 · published 26 days ago
Summary

The JetBlog add‑on for WordPress (versions up to 2.4.10) does not properly clean user input, so a crafted link can cause a web page to run unwanted script. An attacker could use this to steal information or perform actions as a logged‑in user. Update the plugin to the latest version or remove it if you cannot apply the fix.

What to do
  • Update crocoblock jetblog to version 2.4.10.1.
Affected software
VendorProductAffected versions
crocoblock jetblog <= 2.4.10
Fix: upgrade to 2.4.10.1
Original advisory text
WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Oct 2026
Updated26 Oct 2026
First seen9 Oct 2026
Sources
CVE-2026-94661 · NVD
CVE-2026-94661 · MITRE
Track software like this
Free during beta