CVE-2026-116857
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The JetSmartFilters plugin for WordPress (Crocoblock) through version 3.8.6.2 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the site can execute in other users' browsers.
Risk Assessment
An attacker can store a malicious script that executes for visitors and administrators, enabling session theft or account takeover. Any WordPress site running the vulnerable plugin version is at risk.
Recommendation
Update JetSmartFilters to a version later than 3.8.6.2 and review content for injected scripts.
Other vulnerabilities in JetSmartFilters
See all- CVE-2026-114708Medium
The JetSmartFilters plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.8.6.1.
- CVE-2026-48875Critical
There is an unauthenticated SQL Injection vulnerability in JetSmartFilters versions up to 3.8.1.
- CVE-2026-110890Medium
The JetSmartFilters plugin by Crocoblock contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects JetSmartFilters from n/a through 3.8.6.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS