CVE-2025-68498
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The JetTabs plugin by Crocoblock is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.2.12.
Risk Assessment
An attacker can access functions or data they should not have permissions for, potentially leading to unauthorized changes or information disclosure.
Recommendation
Update the JetTabs plugin to the latest patched version. Review access control configuration and restrict permissions.
Other vulnerabilities in JetTabs
See all- CVE-2026-66573Medium
The JetTabs plugin in versions up to and including 2.3.3.1 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.
- CVE-2025-68499Medium
The JetTabs plugin for WordPress (from Crocoblock) contains a DOM-Based XSS vulnerability in versions up to and including 2.2.12. Improper neutralization of input during web page generation allows DOM-based XSS attack.
Original NVD description (English source)
Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS