CVE-2025-68504
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
JetSearch up to version 3.5.16 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.
Risk Assessment
An attacker can hijack user sessions, steal data, or perform unauthorized actions in the victim's context, potentially leading to confidentiality and integrity breaches.
Recommendation
Update JetSearch to the latest version that includes a fix for this vulnerability. Additionally, consider implementing Content Security Policy (CSP) to mitigate XSS risks.
Other vulnerabilities in JetSearch
See all- CVE-2026-49079Critical
JetSearch versions up to 3.5.17 are vulnerable to unauthenticated SQL injection, potentially allowing unauthorized access to data.
- CVE-2026-66577Medium
The JetSearch plugin in versions up to and including 3.6.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
- CVE-2026-61977Medium
The JetSearch WordPress plugin (versions up to 3.6.1.2) contains a vulnerability that allows unauthorized users to access sensitive system information. This flaw enables reading embedded sensitive data, potentially leading to information disclosure.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.16.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS