CVE-2026-61975
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The JetReviews WordPress plugin (versions up to 3.0.1) contains a vulnerability that exposes sensitive system information to unauthorized parties. An attacker can exploit this flaw to retrieve embedded confidential data.
Risk Assessment
The organization is at risk of leaking sensitive data such as system configuration or user information, which could lead to further attacks or privacy breaches.
Recommendation
Immediately update the JetReviews plugin to version 3.0.2 or later if available. If an update is not possible, consider temporarily disabling the plugin.
Other vulnerabilities in JetReviews
See all- CVE-2026-94667Medium
The Crocoblock JetReviews (jet-reviews) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.2.
- CVE-2026-57354Medium
The JetReviews plugin version 3.0.0.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by subscribers. It allows injection of malicious scripts into the page by a user with the subscriber role.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through <= 3.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS