---
id: "CVE-2026-116857"
kind: "vulnerability"
aliases: ["CVE-2026-116857"]
title: "JetSmartFilters WordPress plugin: stored XSS through a filter setting"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "jetsmartfilters", "package", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-version-newer"]
published_at: "2026-10-29T14:17:50+00:00"
first_seen_at: "2026-10-29T14:25:23+00:00"
updated_at: "2026-10-29T14:26:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116857", "first_seen_at": "2026-10-29T14:25:23+00:00"}]
---

# JetSmartFilters WordPress plugin: stored XSS through a filter setting

JetSmartFilters, a WordPress filtering plugin by Crocoblock, fails to sanitize input that is stored and later rendered in pages. An attacker who can submit that input can run scripts in the browser of anyone who views the affected page, such as an admin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed JetSmartFilters plugin version in the WordPress admin under Plugins; the sources say versions through `3.8.6.2` are affected.
- Confirm whether the plugin is active on any public page that renders its filters.

## Fix

- JetSmartFilters: a version later than `3.8.6.2` (the sources do not name the fixed release)

## Timeline

- 2026-10-29T14:25:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116857

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_