CVE-2026-107865
6.5MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Authenticated attackers can execute arbitrary JavaScript in the context of other users or administrators viewing the site. Exploitation requires at least low-privileged account access to inject malicious input and user interaction to trigger it.
Root cause
The plugin improperly neutralizes user-supplied input during web page generation, permitting stored cross-site scripting.
Affected systems
Crocoblock JetMenu through 3.0.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade JetMenu to a version beyond 3.0.5 once released by the vendor, or deactivate and remove the plugin until a patch is available.
$ wp plugin deactivate jet-menuAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.