CVE-2025-68499
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The JetTabs plugin for WordPress (from Crocoblock) contains a DOM-Based XSS vulnerability in versions up to and including 2.2.12. Improper neutralization of input during web page generation allows DOM-based XSS attack.
Risk Assessment
An attacker could exploit this to execute malicious scripts in the victim's browser, potentially leading to data theft, session hijacking, or other harm.
Recommendation
Update the JetTabs plugin to the latest version that includes a fix eliminating the XSS vulnerability.
Other vulnerabilities in JetTabs
See all- CVE-2026-66573Medium
The JetTabs plugin in versions up to and including 2.3.3.1 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.
- CVE-2025-68498Medium
The JetTabs plugin by Crocoblock is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.2.12.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS