CVE-2026-94667
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Crocoblock JetReviews (jet-reviews) plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.2.
Risk Assessment
An attacker could store a malicious script that executes in other users' browsers, potentially leading to session theft or account takeover.
Recommendation
Update JetReviews to a version later than 3.1.2 or apply available mitigations, and consider deploying CSP headers.
Other vulnerabilities in JetReviews
See all- CVE-2026-61975Medium
The JetReviews WordPress plugin (versions up to 3.0.1) contains a vulnerability that exposes sensitive system information to unauthorized parties. An attacker can exploit this flaw to retrieve embedded confidential data.
- CVE-2026-57354Medium
The JetReviews plugin version 3.0.0.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by subscribers. It allows injection of malicious scripts into the page by a user with the subscriber role.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS