Crocoblock develops a suite of WordPress plugins and page-builder extensions for Elementor, with its vulnerability footprint concentrated in products such as Jet Elements, Jet Widgets, and Jet Engine. The vendor's disclosures skew toward serious outcomes, particularly through web-application input-handling and authorization weaknesses including cross-site scripting, CSRF, missing authorization checks, code injection, and improper input validation that are endemic to plugins extending third-party page builders. Defenders should treat updates to this vendor's extensions as priority items, as they directly affect the security posture of WordPress sites relying on these builder tools; live severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Crocoblock over time
Signals from CVEs in this vendor scope (73 CVEs).
73 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-42774CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection.
This issue affects JetEngine: from | May 25, 2026 | 9.3 | 33 | NO | NO |
CVE-2021-41844CRITICAL Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. | Dec 15, 2021 | 9.8 | 30 | NO | NO |
CVE-2026-61977MEDIUM Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affec | Jul 13, 2026 | 5.3 | 29 | NO | NO |
CVE-2026-61975MEDIUM Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue aff | Jul 13, 2026 | 5.3 | 29 | NO | NO |
CVE-2025-49931CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects | Oct 22, 2025 | 9.3 | 29 | NO | NO |
CVE-2026-28134HIGH Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a throu | Mar 5, 2026 | 8.5 | 28 | NO | NO |
CVE-2023-48760CRITICAL Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. | Jun 19, 2024 | 9.8 | 28 | NO | NO |
CVE-2026-4352HIGH The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is | Apr 14, 2026 | 7.5 | 27 | NO | NO |
CVE-2026-32355HIGH Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1. | Mar 13, 2026 | 8.8 | 27 | NO | NO |
CVE-2025-53194HIGH Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0. | Aug 20, 2025 | 8.5 | 27 | NO | NO |
Signals from CVEs in this vendor scope (73 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Crocoblock.
Media articles that mention a CVE ID that affects a product developed by Crocoblock — matched by CVE ID, not by vendor name.