CVE-2025-26744: WordPress JetBlog plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows DOM-Based XSS.This issue affects JetBlog: from n/a through <= 2.4.3.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound JetBlog allows DOM-Based XSS. This issue affects JetBlog: from n/a through 2.4.3.
— NVD
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26744?
CVE-2025-26744 is classified as a high-severity vulnerability due to its potential for abuse via DOM-based cross-site scripting.
How do I fix CVE-2025-26744?
To mitigate CVE-2025-26744, update NotFound JetBlog to version 2.4.4 or later to ensure the vulnerability is patched.
What types of attacks can CVE-2025-26744 facilitate?
CVE-2025-26744 can facilitate DOM-based cross-site scripting attacks, allowing attackers to execute scripts in the context of a user’s browser.
Which versions of JetBlog are affected by CVE-2025-26744?
CVE-2025-26744 affects all versions of NotFound JetBlog up to and including 2.4.3.
Is user data at risk due to CVE-2025-26744?
Yes, CVE-2025-26744 poses a risk to user data as it allows for script execution, which can lead to unauthorized access to cookies and session information.