CVE-2026-48875
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
There is an unauthenticated SQL Injection vulnerability in JetSmartFilters versions up to 3.8.1.
Risk Assessment
An attacker could exploit this vulnerability to gain access to sensitive data in the database, potentially leading to serious security breaches.
Recommendation
It is recommended to update to the latest version of JetSmartFilters to mitigate this vulnerability.
Other vulnerabilities in JetSmartFilters
See all- CVE-2026-114708Medium
The JetSmartFilters plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.8.6.1.
- CVE-2026-116857Medium
The JetSmartFilters plugin for WordPress (Crocoblock) through version 3.8.6.2 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the site can execute in other users' browsers.
- CVE-2026-110890Medium
The JetSmartFilters plugin by Crocoblock contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects JetSmartFilters from n/a through 3.8.6.
Original NVD description (English source)
Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS