CVE-2026-110890
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The JetSmartFilters plugin by Crocoblock contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects JetSmartFilters from n/a through 3.8.6.
Risk Assessment
A malicious script stored in the application may execute in other users' browsers, enabling session theft or actions on their behalf. This can lead to compromise of privileged accounts.
Recommendation
Update the JetSmartFilters plugin to a version later than 3.8.6. Consider deploying Content-Security-Policy headers and sanitizing input.
Other vulnerabilities in JetSmartFilters
See all- CVE-2026-114708Medium
The JetSmartFilters plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.8.6.1.
- CVE-2026-48875Critical
There is an unauthenticated SQL Injection vulnerability in JetSmartFilters versions up to 3.8.1.
- CVE-2026-116857Medium
The JetSmartFilters plugin for WordPress (Crocoblock) through version 3.8.6.2 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the site can execute in other users' browsers.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS