CVE-2026-94667: WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability
Published Oct 9, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.
Affected Software
1 affected component
Crocoblock JetReviews<=3.1.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetReviewsto a version that resolves this vulnerability.Fixed in 3.1.2.1
Event History
Oct 9, 2026
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access and user involvement are required for exploitation?
The vulnerability is remotely reachable and has low attack complexity, but the attacker needs low-level privileges. Exploitation also requires user interaction.
2
What is the potential impact if exploitation succeeds?
The vulnerability is rated medium severity with low potential impact to confidentiality, integrity, and availability. Its scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.