{"id":"CVE-2026-114708","kind":"vulnerability","aliases":["CVE-2026-114708"],"related":[],"title":"JetSmartFilters WordPress plugin: stored XSS through 3.8.6.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1.","summary":"JetSmartFilters, a Crocoblock WordPress plugin for filtering content, has a stored cross-site scripting flaw in versions through 3.8.6.1. An attacker who can store input the plugin later renders can run script in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetsmartfilters","package","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check the installed JetSmartFilters version in the WordPress plugins screen or the plugin header of `jet-smart-filters.php`\n- Confirm whether the installed version is `3.8.6.1` or older","fix":"- Update JetSmartFilters to a version newer than `3.8.6.1`; the sources do not name the fixed version\n- Until updated, restrict who can edit content that the filters render","status":"open","published_at":"2026-10-26T11:16:33+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:31:09+00:00","updated_at":"2026-10-26T11:31:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T11:31:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update JetSmartFilters to a version newer than `3.8.6.1`; the sources do not name the fixed version\n- Until updated, restrict who can edit content that the filters render","reach":"internet","title":"JetSmartFilters WordPress plugin: stored XSS through 3.8.6.1","impact":"medium","summary":"JetSmartFilters, a Crocoblock WordPress plugin for filtering content, has a stored cross-site scripting flaw in versions through 3.8.6.1. An attacker who can store input the plugin later renders can run script in other users' browsers.","category":"package","nicknames":[],"who_cares":["wordpress","jetsmartfilters","crocoblock"],"confidence":0.6,"needs_auth":"unknown","worst_case":"script runs in other users' browsers on the site","analyst_note":"Confirm the fixed version and whether low-privilege contributors can inject the payload, using the NVD entry and Crocoblock's changelog.","how_to_check":"- Check the installed JetSmartFilters version in the WordPress plugins screen or the plugin header of `jet-smart-filters.php`\n- Confirm whether the installed version is `3.8.6.1` or older","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the JetSmartFilters plugin at version 3.8.6.1 or older are exposed, most of all where editors or other users can enter content that is later shown on pages. Sites without the plugin, or running a newer release, can skip it. The sources do not say which configurations are required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000625,"input_tokens":3320,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114708':10A,13A '-2026':9A,12A '3.8.6.1':7A,37B,84C 'affect':79C 'allow':75C 'attack':39B 'browser':54B 'content':25B 'crocoblock':14B,20B,69C 'cross':30B,64C 'cross-sit':29B,63C 'cve':8A,11A 'filter':24B,74C 'flaw':33B 'generat':62C 'improp':55C 'input':43B,58C 'issu':78C 'jet':72C 'jet-smart-filt':71C 'jetsmartfilt':1A,15B,18B,70C,80C 'later':46B 'n/a':82C 'neutral':56C 'packag':16B 'page':61C 'plugin':3A,22B,45B 'render':47B 'run':49B 'script':32B,50B,66C 'site':31B,65C 'smart':73C 'store':4A,28B,42B,76C 'user':53B 'version':35B 'vulner':67C 'web':60C 'wordpress':2A,17B,21B 'xss':5A 'xss.this':77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetSmartFilters plugin at version 3.8.6.1 or older are exposed, most of all where editors or other users can enter content that is later shown on pages. Sites without the plugin, or running a newer release, can skip it. The sources do not say which configurations are required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114708","severity":null,"published_at":"2026-10-26T11:16:33+00:00","modified_at":"2026-10-26T11:16:33+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}