CVE-2026-93618

Executive Summary

CVE-2026-93618 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetTricks, a WordPress plugin published by Jetimpex Inc. that extends the Elementor page builder with additional widget and animation functionality. The flaw affects all versions from n/a through 2.0.1 and allows an authenticated attacker with low privileges to inject persistent script content that executes in the browser context of other users, including administrators, when they view the compromised page. With a CVSS base score of 6.5 and scope change (S:C), the vulnerability can affect resources beyond the vulnerable component's security authority — a hallmark of stored XSS where the executing script inherits the trust of the hosting origin.

Technical Analysis

The NVD classification places this issue under CWE-79, Improper Neutralization of Input During Web Page Generation, with the specific qualifier that the vulnerability is the stored (persistent) variant. This means that attacker-supplied input is not merely reflected back within a single response, but is written into a storage layer — for a WordPress plugin, typically the site database (e.g., via post meta, widget settings, or plugin option records) — and later rendered into HTML pages without adequate output encoding or sanitization.

The affected component is the JetTricks plugin, which operates inside the WordPress/Elementor ecosystem. Elementor-based plugins commonly accept user-configurable field values through the WordPress AJAX/REST admin surface and persist them as serialized widget settings. When any of those saved values is later emitted into the front-end (or admin-side) DOM without escaping, any stored markup — including <script> elements or attribute-based event handlers — becomes executable script running under the site's origin.

Key characteristics derivable from the provided data:

• Vulnerability class: Stored/Persistent XSS (CWE-79). The input neutralization failure occurs during web page generation, indicating the sanitization gap is on the output/rendering path rather than solely on input acceptance.
• Privileges required (PR:L): The attacker needs at least a low-privileged authenticated account. In a WordPress context this is consistent with a Contributor or Author-level user — someone able to create or influence stored content that reaches a rendered page.
• User interaction (UI:R): A victim must load the page or view the component where the payload is rendered. The attacker cannot force execution purely through the request path.
• Scope change (S:C): Script execution crosses a trust boundary; the injected code runs with the privileges of the hosting origin, enabling actions on behalf of the viewing user.
• Impact subscores (C:L/I:L/A:L): Confidentiality, integrity, and availability impacts are all rated Low, consistent with the typical consequence profile of XSS — session/token theft, unauthorized actions performed as the victim, and client-side defacement, rather than full server compromise.

The exact parameter names, functions, and rendering hooks responsible for the missing neutralization are not enumerated in the available NVD description or CNA title. No function names, REST routes, file paths, or API parameters beyond the plugin name itself are disclosed in the source data, and none should be assumed. The technical mechanism is therefore characterized here at the vulnerability-class level: untrusted input reaches a persistence layer and is subsequently reflected into generated HTML without sufficient encoding or sanitization.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-93618. The following chain is inferred strictly from the vulnerability class (stored XSS) and the CVSS metrics supplied; no implementation-specific details are asserted.

1. Reconnaissance / target identification. The attacker identifies WordPress sites running Elementor alongside the JetTricks plugin at version 2.0.1 or earlier. Detection is feasible through public web-fingerprinting — asset enumeration of plugin paths, HTML source markers, or plugin-detection tooling. Shodan dorks targeting plugin assets (see METADATA) can be used to build a target list at scale.

2. Triggering the flaw class. Using an authenticated low-privileged account (PR:L), the attacker supplies crafted input through whatever content-authoring or configuration surface the plugin exposes. Because the flaw is the stored variant, the payload is persisted server-side — in the database or plugin storage — rather than being reflected only in the immediate response. The specific input field is not identified in the available data; the defining property is that the value is stored and later rendered.

3. Payload and execution. When the injected content is subsequently rendered into a page viewed by another user (UI:R), the stored script executes in that victim's browser under the site's origin. Because the payload is persistent, execution does not require the victim to click a crafted link each time; any page load rendering the stored value is sufficient. The scope change (S:C) means the executing script acts with the trust of the hosting origin.

4. Post-exploitation impact. Typical stored XSS outcomes apply: theft of session cookies or authentication tokens, performing privileged actions in the victim's authenticated session (for example, an administrator viewing an infected page), injection of further malicious content, or client-side redirection and defacement. The Low C/I/A subscores indicate the impact favors session and content manipulation over direct server-side code execution.

Per the stated rules, no hypothetical function names, endpoints, or parameter names are fabricated to complete this section. The attack chain is presented at the vulnerability-class level because the source data does not disclose implementation specifics.

Impact Assessment

• Confidentiality (C:L): Limited disclosure. Realistic exposure includes session cookies, CSRF tokens, and page content visible to the executing script within the victim's browser context.
• Integrity (I:L): Limited modification. A script executing under the site origin can alter page content seen by victims and, in an authenticated victim's session, submit state-changing requests.
• Availability (A:L): Limited disruption, typically client-side (for example, breaking page rendering for affected users), rather than service-wide outage.
• Scope (S:C): The vulnerability's impact extends beyond the vulnerable component. Script execution transcends the plugin boundary into the wider site origin.
• Blast radius: Every visitor and authenticated user who renders the page containing the persisted payload is potentially affected. The most severe consequence arises when an administrator loads the infected page, because the injected script then operates within an elevated session — a classic privilege-escalation vector for stored XSS in CMS plugins.
• Base score: 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The high attack-surface reach (network) and low attack complexity are offset by the prerequisite of an authenticated account and required victim interaction.
• Exploitability context: No EPSS score is available (not yet scored by FIRST.org), no CISA KEV listing exists, and no public exploit or PoC is known. This does not reduce the inherent risk of a persistent XSS flaw in a widely used page-builder extension, but it does mean mass opportunistic exploitation has not been documented.

Detection Guidance

Sigma Rule

Stored XSS detection is best approached by observing the persistence step — a low-privileged user submitting markup-bearing content through WordPress/Elementor admin requests — combined with web-server logs capturing script-like payloads in query strings or request bodies. The rule below targets the request patterns generically; tune field names to your environment.

title: Potential Stored XSS Payload Submission via WordPress Elementor Plugin (CVE-2026-93618)
id: 8f4c1e2a-9361-8cve-2026-93618
status: experimental
description: Detects low-privileged authenticated requests to WordPress admin endpoints containing script-like payloads consistent with stored XSS injection against JetTricks <= 2.0.1
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93618
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
  selection_path:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/'
      - '/wp-admin/post.php'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'onmouseover='
      - '<img'
      - '<svg'
  condition: selection_method and selection_path and selection_payload
falsepositives:
  - Legitimate administrative content authoring with raw HTML
  - Security scanners and WAF test traffic
level: medium
tags:
  - attack.t1190
  - cwe.79

YARA Rule

The following YARA rule hunts for stored XSS payload artifacts in exported database dumps or stored plugin configuration content. Adjust $plugin_marker to match the exact plugin slug in your environment.

rule CVE_2026_93618_JetTricks_Stored_XSS
{
    meta:
        description = "Detects stored XSS payload markers in JetTricks plugin data (CVE-2026-93618)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93618"
        cve = "CVE-2026-93618"

    strings:
        $plugin_marker = "jettricks" nocase

        $xss1 = "<script" nocase
        $xss2 = "javascript:" nocase
        $xss3 = "onerror=" nocase
        $xss4 = "onload=" nocase
        $xss5 = "onmouseover=" nocase
        $xss6 = "document.cookie" nocase
        $xss7 = "<svg/onload" nocase

    condition:
        uint16(0) == 0x3C3F or
        ($plugin_marker and any of ($xss*)) or
        (2 of ($xss*))
}

Suricata IDS Rule

This rule inspects HTTP POST traffic for common XSS payload tokens directed at WordPress administrative endpoints. Because the specific vulnerable parameter is undisclosed, detection is signature-based at the payload level and will require tuning.

alert http any any -> any any ( \
  msg:"CVE-2026-93618 Possible JetTricks Stored XSS Injection Attempt"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.uri; content:"wp-admin" nocase; \
  http.request_body; content:"<script"; nocase; \
  http.request_body; content:"</script>"; nocase; \
  classtype:web-application-attack; \
  reference:cve,CVE-2026-93618; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93618; \
  sid:9361801; rev:1; )

A second rule flags event-handler-based payloads that bypass <script> filtering:

alert http any any -> any any ( \
  msg:"CVE-2026-93618 Possible JetTricks Stored XSS Event Handler Payload"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.uri; content:"wp-admin" nocase; \
  pcre:"/(onerror|onload|onmouseover|onfocus)\\s*=/iU"; \
  classtype:web-application-attack; \
  reference:cve,CVE-2026-93618; \
  sid:9361802; rev:1; )

Elastic Detection

This EQL rule correlates a low-privileged user writing script-like content and a subsequent admin-driven page render, which is the characteristic pattern of stored XSS reaching an elevated victim.

sequence by user.name with maxspan=30m
  [ any where
      event.category == "web" and
      http.request.method == "POST" and
      wildcard(http.request.body, "*<script*", "*javascript:*", "*onerror=*", "*onload=*") and
      wildcard(url.path, "*wp-admin*", "*wp-json*") ]
  [ any where
      event.category == "web" and
      http.request.method == "GET" and
      wildcard(url.path, "*wp-admin*") and
      user.name != null ]

If the data source distinguishes roles, add a filter such as wildcard(user.roles, "*administrator*") to the second sequence step to sharpen precision toward the stored-XSS-to-admin-session escalation pattern.

Splunk SPL Query

The following SPL hunts web logs for stored XSS injection attempts against WordPress admin surfaces, aggregating by source IP to surface repeated attempts. Field names follow the Splunk Web CIM; substitute uri_query/form_data as available.

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
(http.url_path="/wp-admin/admin-ajax.php" OR http.url_path="/wp-json/*" OR http.url_path="/wp-admin/post.php")
http.method=POST
(form_data="*<script*" OR form_data="*javascript:*" OR form_data="*onerror=*" OR uri_query="*%3Cscript*" OR uri_query="*<script*")
| stats count min(_time) as first_seen max(_time) as last_seen
    values(url) as urls by src_ip, http.url_path
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

A complementary search looks for the persistence artifact by scanning saved post/option content for script tokens:

index=wordpress (sourcetype=wpmysql OR sourcetype=mysql:audit)
| regex post_content="(?i)(<script|javascript:|onerror=|onload=|onmouseover=)"
| table _time, post_id, post_author, post_title
| sort - _time

Wazuh OSSEC Rule

This Wazuh ruleset extends the built-in web rules to detect script-bearing POST requests to WordPress admin endpoints. The parent rule 31100 series covers web-access logging; adapt web.accesslog decoding to your deployment.

<group name="web,appsec,wordpress,cve-2026-93618,">
  <rule id="100936" level="10">
    <if_sid>31100</if_sid>
    <field name="url">/wp-admin/admin-ajax.php|/wp-json/|/wp-admin/post.php</field>
    <regex type="pcre2">(?i)(%3Cscript|<script|javascript:|onerror\s*=|onload\s*=|onmouseover\s*=)</regex>
    <description>CVE-2026-93618: Possible JetTricks stored XSS payload submitted to WordPress admin endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,attack,</group>
  </rule>

  <rule id="100937" level="12">
    <if_sid>100936</if_sid>
    <field name="id">administrator|admin</field>
    <description>CVE-2026-93618: Stored XSS injection correlated with administrative session activity</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no vendor fix available):

• Restrict public exposure of the WordPress administrative surface. Limit /wp-admin and /wp-json access to trusted IP ranges or require an authenticated reverse-proxy gate.
• Enforce least privilege on content-authoring roles. Audit which users hold Contributor/Author capabilities and can therefore submit content through plugin surfaces that render on shared pages. Deploy author-level content review, since the PR:L requirement means a legitimate low-privileged account is the injection vector.
• Deploy a WAF with XSS-focused virtual patching rules (script tags, event-handler attributes, javascript: URIs) targeting WordPress admin endpoints. Tune carefully to reduce false positives against legitimate rich content.
• Enable a Content Security Policy (CSP) that restricts inline script execution (script-src with nonces or hashes, no unsafe-inline). CSP materially reduces stored XSS impact even when the injection succeeds, because it blocks the payload's execution in the victim browser — directly mitigating the S:C scope escalation.
• Set session cookies with HttpOnly and Secure attributes and apply SameSite restrictions to limit token theft from executed scripts.

2. Patch / upgrade steps:

• No patched version is available through version 2.0.1. Monitor the Crocoblock / Jetimpex Inc. release channels and the NVD page for CVE-2026-93618 for an official fix. Until a patched release is published, treat the plugin as vulnerable at all versions up to and including 2.0.1.
• If the plugin functionality is not required, disable and remove JetTricks to eliminate the attack surface entirely.
• When an update is released, stage and validate it in a non-production environment, then apply it broadly. Track the plugin version in your software inventory so affected instances can be identified quickly.

3. Long-term hardening:

• Maintain an inventory of WordPress plugins and their versions, and integrate it into vulnerability management so future advisories can be mapped to affected instances automatically.
• Enforce output encoding and contextual escaping as a plugin development standard if you build custom extensions on the Elementor platform; stored XSS is prevented at the render layer.
• Adopt defense-in-depth: WAF virtual patching, CSP, security headers, and continuous monitoring of web logs for script-bearing admin requests.
• Establish a recurring privileged-account review so that role assignments in the CMS do not drift toward over-permissioning.

References

• NVD — CVE-2026-93618: https://nvd.nist.gov/vuln/detail/CVE-2026-93618
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• Crocoblock JetTricks plugin product page (vendor): https://crocoblock.com/plugins/jettricks/
• FIRST EPSS (score not yet assigned for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-93618 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, Nuclei template, or exploit code is known for CVE-2026-93618. No exploit-in-the-wild activity or threat-actor campaign has been documented in the available data, and the CVE is not listed in CISA KEV. Detection guidance above is inferred from the stored-XSS vulnerability class and should be tuned to the target environment.