CVE-2026-85683: Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL

Q: Does exploitation require an attacker account or administrator interaction?

No attacker account is required. An unauthenticated attacker can reach the affected form handler; exploitation succeeds when someone, including an administrator, visits the published page that has been bound to the attacker-controlled remote document.

Q: Who is at risk from a successful exploit?

Any visitor who loads the affected published page may execute attacker-supplied JavaScript in their browser. This includes administrators, so the impact can extend to administrative sessions.

Q: What plugin versions are affected?

Jane Menu versions before 1.5.1 are affected.

Published Oct 21, 2026

Updated

The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.

Affected Software

1 affected component

Jane Menu<1.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Jane Menu to a version that resolves this vulnerability.
Fixed in 1.5.1

Event History

Oct 21, 2026

CVE Published

via MITRE·08:39 AM

Data Sourced

via MITRE·08:39 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an attacker account or administrator interaction?

No attacker account is required. An unauthenticated attacker can reach the affected form handler; exploitation succeeds when someone, including an administrator, visits the published page that has been bound to the attacker-controlled remote document.

Who is at risk from a successful exploit?