CVE-2026-125835: WordPress JetTabs plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.3.5.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack vector is network-accessible, but exploitation requires low-level privileges and user interaction. The provided data does not identify which WordPress role or capability provides the required privileges.
What is the impact if exploitation succeeds?
This is a stored XSS issue in JetTabs. The supplied vector indicates potential confidentiality, integrity, and availability impact, all rated low, with scope changed.
Which JetTabs versions are affected?
JetTabs versions through 2.3.5 are affected. The lower bound is listed as unspecified.