CVE-2026-66573
MediumCVSS 6.5Summary
The JetTabs plugin in versions up to and including 2.3.3.1 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.
Risk Assessment
The malicious script may execute in the browsers of other users, including administrators, risking session theft and account takeover. This can ultimately compromise the entire site.
Recommendation
Update the JetTabs plugin to a version newer than 2.3.3.1. Also consider reviewing Contributor accounts and restricting their privileges.
Other vulnerabilities in JetTabs
See all- CVE-2025-68499Medium
The JetTabs plugin for WordPress (from Crocoblock) contains a DOM-Based XSS vulnerability in versions up to and including 2.2.12. Improper neutralization of input during web page generation allows DOM-based XSS attack.
- CVE-2025-68498Medium
The JetTabs plugin by Crocoblock is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.2.12.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS