Vulnerabilities in Crocoblock

92 results
Vexday analysis

Com 89 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o perfil de risco ativo do Crocoblock situa-se abaixo da média geral do catálogo, sem registros de exploração confirmada no momento. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em ecossistemas de plugins web e que frequentemente serve de vetor para encadeamento com outras vulnerabilidades. A CVE mais perigosa identificada atualmente é CVE-2024-7146, com escore EPSS de 0,0096, indicando baixa probabilidade de exploração ativa no curto prazo, embora a existência de 3 CVEs críticas e 3 vulnerabilidades surgidas nos últimos 90 dias sinalize que o volume de descobertas recentes merece acompanhamento contínuo. A ausência de PoCs públicas conhecidas reduz, por ora, a superfície de exploração imediata, mas não substitui a necessidade de priorizar a aplicação de correções nas falhas críticas.

CVE-2024-7146HIGHJetTabs <= 2.2.3 - Authenticated (Contributor+) Arbitrary Local File InclusionEPSS 1.0%CVE-2024-7145HIGHJetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File InclusionEPSS 0.9%CVE-2023-37866HIGHWordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerabilityEPSS 0.8%CVE-2023-39157CRITICALWordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)EPSS 0.7%CVE-2024-37497HIGHWordPress JetThemeCore plugin < 2.2.1 - Subscriber+ Arbitrary File Deletion vulnerabilityEPSS 0.7%CVE-2025-22279HIGHWordPress JetCompareWishlist plugin <= 1.5.9 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2025-31016HIGHWordPress JetWooBuilder plugin <= 2.1.18 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2023-48757HIGHWordPress JetEngine plugin <= 3.2.4 - Privilege Escalation vulnerabilityEPSS 0.6%CVE-2024-43221HIGHWordPress JetGridBuilder plugin <= 1.1.2 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2025-39396HIGHWordPress JetReviews plugin <= 2.3.6 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2024-38772MEDIUMWordPress JetWidgets for Elementor and WooCommerce plugin <= 1.1.7 - Contributor+ Limited Local File Inclusion vulnerabilityEPSS 0.5%CVE-2025-53196MEDIUMWordPress JetEngine <= 3.7.0 - Sensitive Data Exposure VulnerabilityEPSS 0.5%CVE-2025-49921HIGHWordPress JetReviews plugin <= 3.0.0 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2023-48760HIGHWordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-26953HIGHWordPress JetMenu plugin <= 2.4.9 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2023-48756HIGHWordPress JetBlocks For Elementor Plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-48759HIGHWordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerabilityEPSS 0.4%CVE-2025-49931CRITICALWordPress JetSearch plugin <= 3.5.10 - SQL Injection vulnerabilityEPSS 0.4%CVE-2023-48763MEDIUMWordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerabilityEPSS 0.4%CVE-2026-42774CRITICALWordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerabilityEPSS 0.4%