CVE-2026-94667
MediumCVSS 6.5Summary
The Crocoblock JetReviews (jet-reviews) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.2.
Risk Assessment
An attacker could store a malicious script that executes in other users' browsers, potentially leading to session theft or account takeover.
Recommendation
Update JetReviews to a version later than 3.1.2 or apply available mitigations, and consider deploying CSP headers.
Other vulnerabilities in JetReviews
See all- CVE-2026-57354Medium
The JetReviews plugin version 3.0.0.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by subscribers. It allows injection of malicious scripts into the page by a user with the subscriber role.
- CVE-2026-61975Medium
The JetReviews WordPress plugin (versions up to 3.0.1) contains a vulnerability that exposes sensitive system information to unauthorized parties. An attacker can exploit this flaw to retrieve embedded confidential data.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS