CVE-2026-94661: WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetBlog pluginto a version that resolves this vulnerability.Fixed in 2.4.10.1
Event History
Frequently Asked Questions
Which JetBlog versions are affected?
JetBlog versions through 2.4.10 are affected. The earliest affected version is not specified.
What does an attacker need to exploit this issue?
The vector is network-accessible, requires low attack complexity, and does not require privileges. Exploitation does require user interaction, consistent with reflected XSS.
What impact could successful exploitation have?
The vulnerability is rated high severity with a 7.1 score. It can result in low impact to confidentiality, integrity, and availability, and its scope may extend beyond the vulnerable component.