CVE-2026-66573: WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability
Published Sep 17, 2026
·Updated
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
Affected Software
1 affected component
WordPress JetTabs Plugin<=2.3.3.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetTabs Pluginto a version that resolves this vulnerability.Fixed in 2.3.3.2
Event History
Sep 17, 2026
CVE Published
via MITRE·01:24 PM
Data Sourced
via MITRE·01:24 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Contributor-level privileges in WordPress. Exploitation also requires user interaction, according to the UI:R vector.
2
What is the potential impact?
The vulnerability can allow cross-site scripting and is rated medium severity with low confidentiality, integrity, and availability impact. The scope is changed, meaning the impact may extend beyond the vulnerable plugin's immediate security authority.
3
Which plugin versions are affected?
JetTabs versions 2.3.3.1 and earlier are identified as affected.