CVE-2026-110890

5th percentile - higher than 5% of all known CVEs

The JetSmartFilters plugin by Crocoblock contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects JetSmartFilters from n/a through 3.8.6.

A malicious script stored in the application may execute in other users' browsers, enabling session theft or actions on their behalf. This can lead to compromise of privileged accounts.

Update the JetSmartFilters plugin to a version later than 3.8.6. Consider deploying Content-Security-Policy headers and sanitizing input.