CVE-2026-116857: WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetSmartFilters (jet-smart-filters)to a version that resolves this vulnerability.Fixed in 3.8.6.3
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs at least low-level privileges and must be able to induce a user to interact with the malicious content. The network attack vector indicates exploitation can be initiated remotely.
What is the likely impact if exploitation succeeds?
The vulnerability is a stored XSS issue, meaning injected script may be retained and later executed in affected web pages. The supplied vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.
Which JetSmartFilters versions are affected?
JetSmartFilters versions through 3.8.6.2 are affected. The available data does not identify a fixed version.
How urgent is remediation?
The issue is rated medium severity with a CVSS score of 6.5. Prioritize affected installations where low-privileged users can submit or modify content that is later viewed by other users.