CVE-2026-93618: JetTricks WordPress Plugin XSS Vulnerability

CVE-2026-93618 Overview

CVE-2026-93618 is a stored cross-site scripting (XSS) vulnerability in the Crocoblock JetTricks plugin for WordPress, developed by Jetimpex Inc. The flaw stems from improper neutralization of user input during web page generation, classified under [CWE-79]. Authenticated contributors can inject malicious scripts that persist in the database and execute in the browsers of site visitors and administrators. All versions of JetTricks from initial release through 2.0.1 are affected.

Critical Impact

Attackers with low-privileged accounts can store JavaScript payloads that execute in other users' sessions, enabling session theft, administrative account takeover, and site defacement on affected WordPress installations.

Affected Products

• Crocoblock JetTricks WordPress plugin (Jetimpex Inc.)
• All versions from initial release through 2.0.1
• WordPress sites running vulnerable JetTricks installations

Discovery Timeline

• 2026-09-23 - CVE CVE-2026-93618 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93618

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the JetTricks plugin, which extends the Elementor page builder with visual effects and layout widgets. The plugin fails to properly sanitize user-supplied input before rendering it into WordPress pages. An authenticated user with contributor-level access or higher can inject JavaScript into widget configuration fields or shortcode parameters. The malicious payload is persisted in the WordPress database and executes each time a victim renders the affected page.

Exploitation requires user interaction, and the scope changes when the payload executes in a higher-privileged administrator context. Successful attacks compromise confidentiality, integrity, and availability of the WordPress site.

Root Cause

The root cause is missing or inadequate output encoding in the plugin's rendering pipeline. Input passed to widget attributes is written directly into the generated HTML without escaping characters such as <, >, and ". WordPress provides helpers like esc_html(), esc_attr(), and wp_kses() for this purpose, but the vulnerable code paths do not apply them consistently before version 2.0.1.

Attack Vector

An attacker first obtains an authenticated WordPress account with permission to edit posts or Elementor content. The attacker then crafts a JetTricks widget or shortcode containing a JavaScript payload in an unsanitized field. When another user, typically an administrator previewing or moderating content, loads the affected page, the payload executes in their browser context. The attacker can steal authentication cookies, perform actions on behalf of the victim, or pivot to full site takeover by creating new administrator accounts.

Refer to the Patchstack WordPress XSS Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-93618

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handlers such as onerror= stored in wp_posts or wp_postmeta tables.
• New WordPress administrator accounts created without a corresponding audit trail.
• Outbound requests from administrator browser sessions to unfamiliar domains shortly after loading pages built with JetTricks widgets.

Detection Strategies

• Audit JetTricks widget configurations and shortcode attributes for HTML or JavaScript content that should not be present.
• Review WordPress access logs for POST requests to admin-ajax.php or the Elementor editor endpoints originating from low-privileged contributor accounts.
• Inspect rendered pages for injected script tags using automated web application scanners configured to detect stored XSS.

Monitoring Recommendations

• Enable WordPress activity logging to capture content edits by contributor and author roles.
• Alert on creation of new administrative users or changes to user role capabilities.
• Monitor Content Security Policy (CSP) violation reports for inline script execution on pages managed by Elementor.

How to Mitigate CVE-2026-93618

Immediate Actions Required

• Update the JetTricks plugin to a version later than 2.0.1 as soon as a patched release is available from Crocoblock.
• Audit all contributor, author, and editor accounts and remove any that are unused or unrecognized.
• Review recently edited posts and pages containing JetTricks widgets for injected scripts and remove malicious content.

Patch Information

At the time of publication, the vendor advisory tracked through Patchstack confirms all versions through 2.0.1 are vulnerable. Administrators should monitor the Crocoblock changelog and apply the fixed release immediately upon availability.

Workarounds

• Restrict content editing permissions so that only trusted administrators can create or modify JetTricks widgets until a patch is applied.
• Deploy a Web Application Firewall (WAF) rule set that blocks common XSS payloads in requests to WordPress admin endpoints.
• Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources to limit the impact of successful injection.

# Example Content-Security-Policy header for WordPress
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"