CVE-2026-114708: WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability
Published Oct 26, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1.
Affected Software
1 affected component
Crocoblock JetSmartFilters<=3.8.6.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetSmartFiltersto a version that resolves this vulnerability.Fixed in 3.8.6.2
Event History
Oct 26, 2026
CVE Published
via MITRE·10:36 AM
Data Sourced
via MITRE·10:36 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access and interaction are required for exploitation?
The vector indicates network-reachable exploitation by an attacker with low privileges. Exploitation also requires user interaction.
2
What is the potential impact if exploitation succeeds?
The severity vector indicates low impact to confidentiality, integrity, and availability. The scope is changed, meaning the vulnerable component could affect resources beyond its own security authority.