CVE-2026-66577
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The JetSearch plugin in versions up to and including 3.6.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
Risk Assessment
The script may execute in the browsers of other users, including administrators, enabling session theft or account takeover. This can lead to compromise of the WordPress site.
Recommendation
Update the JetSearch plugin to a version newer than 3.6.3. Until then, limit the number of accounts with Contributor privileges.
Other vulnerabilities in JetSearch
See all- CVE-2026-49079Critical
JetSearch versions up to 3.5.17 are vulnerable to unauthenticated SQL injection, potentially allowing unauthorized access to data.
- CVE-2026-61977Medium
The JetSearch WordPress plugin (versions up to 3.6.1.2) contains a vulnerability that allows unauthorized users to access sensitive system information. This flaw enables reading embedded sensitive data, potentially leading to information disclosure.
- CVE-2025-68504Medium
JetSearch up to version 3.5.16 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS