CVE-2026-57354
MediumCVSS 6.5Summary
The JetReviews plugin version 3.0.0.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by subscribers. It allows injection of malicious scripts into the page by a user with the subscriber role.
Risk Assessment
An attacker with subscriber role can steal other users' sessions, redirect them to malicious sites, or exfiltrate sensitive data, compromising system confidentiality and integrity.
Recommendation
Immediately update the JetReviews plugin to a version newer than 3.0.0.1, which includes a fix for the XSS vulnerability.
Other vulnerabilities in JetReviews
See all- CVE-2026-94667Medium
The Crocoblock JetReviews (jet-reviews) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.2.
- CVE-2026-61975Medium
The JetReviews WordPress plugin (versions up to 3.0.1) contains a vulnerability that exposes sensitive system information to unauthorized parties. An attacker can exploit this flaw to retrieve embedded confidential data.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS