CVE-2026-107867: WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetProductTablesto a version that resolves this vulnerability.Fixed in 1.2.4.1
Event History
Frequently Asked Questions
Which installations are affected?
JetProductTables versions through 1.2.4 are affected. The available data does not identify a fixed version.
Can this be exploited remotely without an account?
The CVSS vector indicates network-reachable exploitation with low attack complexity and no privileges required. Exploitation does require user interaction.
What impact can successful exploitation have?
The issue is a reflected XSS vulnerability with low confidentiality, integrity, and availability impact according to the supplied CVSS metrics. Its scope is changed, meaning effects may extend beyond the vulnerable component's security authority.