CVE-2026-107865: WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetMenuto a version that resolves this vulnerability.Fixed in 3.0.5.1
Event History
Frequently Asked Questions
Which deployments are affected?
JetMenu versions through 3.0.5 are affected. The available information does not identify any unaffected fixed version.
What access does an attacker need to exploit this issue?
The severity vector indicates that an attacker needs low-level privileges and user interaction. Exploitation can be performed over the network with low attack complexity.
What impact can successful exploitation have?
This is a stored XSS issue. The provided severity vector indicates low confidentiality, integrity, and availability impact, with scope changed.