CVE-2026-114708
MediumCVSS 6.5Summary
The JetSmartFilters plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.8.6.1.
Risk Assessment
An attacker can store a malicious script that executes in the browsers of users visiting the site, potentially leading to session theft or account takeover. The risk applies to WordPress sites using this plugin.
Recommendation
Update JetSmartFilters to a version later than 3.8.6.1 or apply the available workaround. Additionally, consider implementing input filtering and a Content Security Policy.
Other vulnerabilities in JetSmartFilters
See all- CVE-2026-48875Critical
There is an unauthenticated SQL Injection vulnerability in JetSmartFilters versions up to 3.8.1.
- CVE-2026-116857Medium
The JetSmartFilters plugin for WordPress (Crocoblock) through version 3.8.6.2 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the site can execute in other users' browsers.
- CVE-2026-110890Medium
The JetSmartFilters plugin by Crocoblock contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects JetSmartFilters from n/a through 3.8.6.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS