{"id":"CVE-2026-116857","kind":"vulnerability","aliases":["CVE-2026-116857"],"related":[],"title":"JetSmartFilters WordPress plugin: stored XSS through a filter setting","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.","summary":"JetSmartFilters, a WordPress filtering plugin by Crocoblock, fails to sanitize input that is stored and later rendered in pages. An attacker who can submit that input can run scripts in the browser of anyone who views the affected page, such as an admin.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","jetsmartfilters","package","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-newer"],"how_to_check":"- Check the installed JetSmartFilters plugin version in the WordPress admin under Plugins; the sources say versions through `3.8.6.2` are affected.\n- Confirm whether the plugin is active on any public page that renders its filters.","fix":"- JetSmartFilters: a version later than `3.8.6.2` (the sources do not name the fixed release)","status":"open","published_at":"2026-10-29T14:17:50+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:05+00:00","updated_at":"2026-10-29T14:26:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T14:26:05Z","model":"claude-haiku-5-5","output":{"fix":"- JetSmartFilters: a version later than `3.8.6.2` (the sources do not name the fixed release)","reach":"internet","title":"JetSmartFilters WordPress plugin: stored XSS through a filter setting","impact":"medium","summary":"JetSmartFilters, a WordPress filtering plugin by Crocoblock, fails to sanitize input that is stored and later rendered in pages. An attacker who can submit that input can run scripts in the browser of anyone who views the affected page, such as an admin.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","jetsmartfilters","elementor"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' or admins' browsers on affected pages","analyst_note":"Find the fixed version and the required privilege level from the NVD entry and the Crocoblock changelog (https://nvd.nist.gov/vuln/detail/CVE-2026-116857).","how_to_check":"- Check the installed JetSmartFilters plugin version in the WordPress admin under Plugins; the sources say versions through `3.8.6.2` are affected.\n- Confirm whether the plugin is active on any public page that renders its filters.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-newer"],"who_is_affected":"Sites running JetSmartFilters 3.8.6.2 or earlier, where the plugin's filter output is shown on pages. The sources do not say which roles can submit the stored input, so the required privilege level is unknown. Sites without the plugin are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000722,"input_tokens":4128,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116857':12A,15A '-2026':11A,14A '3.8.6.2':92C 'admin':62B 'affect':57B,87C 'allow':83C 'anyon':53B 'attack':40B 'browser':51B 'crocoblock':26B,77C 'cross':72C 'cross-sit':71C 'cve':10A,13A 'elementor':16B 'fail':27B 'filter':8A,23B,82C 'generat':70C 'improp':63C 'input':30B,45B,66C 'issu':86C 'jet':80C 'jet-smart-filt':79C 'jetsmartfilt':1A,17B,20B,78C,88C 'later':35B 'n/a':90C 'neutral':64C 'packag':18B 'page':38B,58B,69C 'plugin':3A,24B 'render':36B 'run':47B 'sanit':29B 'script':48B,74C 'set':9A 'site':73C 'smart':81C 'store':4A,33B,84C 'submit':43B 'view':55B 'vulner':75C 'web':68C 'wordpress':2A,19B,22B 'xss':5A 'xss.this':85C","nicknames":[],"mitigations":[],"who_affected":"Sites running JetSmartFilters 3.8.6.2 or earlier, where the plugin's filter output is shown on pages. The sources do not say which roles can submit the stored input, so the required privilege level is unknown. Sites without the plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116857","severity":null,"published_at":"2026-10-29T14:17:50+00:00","modified_at":"2026-10-29T14:17:50+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}