Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T09:16:42.313Z",
  "pubdate": "2026-10-12T09:16:42.313Z",
  "executiveSummary": "The Crocoblock JetMenu plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').\nThis vulnerability exists within JetMenu versions ranging from n/a through 3.0.5.\nThe flaw allows an authenticated attacker to inject malicious scripts into the application, which are subsequently stored in the database.\nWhen a user, such as an administrator or other site visitor, views the affected page, the malicious script executes within their browser context.\nThis can lead to unauthorized actions, session hijacking, cookie theft, or unauthorized redirection, posing a significant risk to the integrity and confidentiality of the affected WordPress site.\nSuccessful exploitation requires the attacker to have sufficient privileges to manipulate input fields processed by the vulnerable component.\nThis is a critical security concern that necessitates immediate attention and remediation by site administrators to prevent potential compromise of user sessions and data.",
  "technicalDetails": "The vulnerability originates from a lack of adequate input validation and output encoding in the JetMenu plugin's handling of user-supplied data.\nSpecifically, the plugin fails to properly neutralize scripts submitted through input fields that are later rendered on web pages without sanitization.\nAs a Stored XSS vulnerability, the payload is persistently stored in the site's database after being submitted by an attacker.\nThe attack flow typically follows these steps: 1. The attacker, possessing sufficient privileges to access JetMenu settings or configuration interfaces, inputs a crafted JavaScript payload into an input field susceptible to the vulnerability.\n2. The plugin processes this input and stores it within the database without stripping malicious HTML tags or script elements.\n3. When a victim loads a front-end or back-end page where this stored content is rendered, the web application outputs the malicious script directly into the document object model (DOM) of the victim's browser.\n4. The victim's browser executes the injected script, believing it to be legitimate code provided by the site.\nThis execution happens within the context of the victim's session. If the victim has higher privileges, such as an administrator, the script can perform actions on their behalf, including creating new users, changing security settings, or installing malicious plugins.\nBecause the payload is stored, it remains active every time the affected page is rendered, ensuring a continuous threat until the payload is manually removed from the database or the underlying vulnerability is patched.\nThe vulnerability affects versions n/a through 3.0.5 of JetMenu. It is not limited to specific network configurations but is rather an inherent flaw in the plugin's code handling user inputs.\nThe impact is significant due to the potential for administrative account takeover, data exfiltration, or the propagation of further attacks through the compromised system."
}