{"id":"CVE-2026-125835","kind":"vulnerability","aliases":["CVE-2026-125835"],"related":[],"title":"JetTabs WordPress plugin: stored XSS through input handling","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5.","summary":"JetTabs, a Crocoblock WordPress plugin for tabbed content, does not neutralize some input before it is written into pages. An attacker who can store content can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jettabs","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed JetTabs (jet-tabs) plugin version in the WordPress admin plugin list or `wp plugin get jet-tabs --field=version`\n- Confirm whether the site uses JetTabs widgets on public pages","fix":"- JetTabs (jet-tabs): versions through `2.3.5` are affected; the sources do not name a fixed version","status":"open","published_at":"2026-11-13T15:17:42+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","triaged_at":"2026-11-13T15:48:47+00:00","updated_at":"2026-11-13T15:48:47+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T15:48:47Z","model":"claude-haiku-5-5","output":{"fix":"- JetTabs (jet-tabs): versions through `2.3.5` are affected; the sources do not name a fixed version","reach":"internet","title":"JetTabs WordPress plugin: stored XSS through input handling","impact":"medium","summary":"JetTabs, a Crocoblock WordPress plugin for tabbed content, does not neutralize some input before it is written into pages. An attacker who can store content can run scripts in other visitors' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","jettabs","crocoblock"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers and steal sessions or act as them.","analyst_note":"Find the fixed version of jet-tabs after 2.3.5 and the exact authentication level needed to store the payload, from the NVD or Crocoblock/Wordfence advisory.","how_to_check":"- Check the installed JetTabs (jet-tabs) plugin version in the WordPress admin plugin list or `wp plugin get jet-tabs --field=version`\n- Confirm whether the site uses JetTabs widgets on public pages","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the JetTabs (jet-tabs) WordPress plugin version 2.3.5 or earlier. The flaw is stored XSS, so exposure depends on whether users with lower privileges can save content that the plugin renders. Sites without JetTabs are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4546,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125835':11A,14A '-2026':10A,13A '2.3.5':79C 'affect':74C 'allow':70C 'attack':39B 'browser':50B 'content':26B,43B 'crocoblock':15B,21B,65C 'cross':60C 'cross-sit':59C 'cve':9A,12A 'generat':58C 'handl':8A 'improp':51C 'input':7A,31B,54C 'issu':73C 'jet':68C 'jet-tab':67C 'jettab':1A,16B,19B,66C,75C 'n/a':77C 'neutral':29B,52C 'page':37B,57C 'plugin':3A,23B 'run':45B 'script':46B,62C 'site':61C 'store':4A,42B,71C 'tab':25B,69C 'visitor':49B 'vulner':63C 'web':56C 'wordpress':2A,18B,22B 'written':35B 'xss':5A 'xss.this':72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetTabs (jet-tabs) WordPress plugin version 2.3.5 or earlier. The flaw is stored XSS, so exposure depends on whether users with lower privileges can save content that the plugin renders. Sites without JetTabs are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crocoblock","jettabs","medium","other","wordpress"],"campaign_type":null,"search_a":"'-125835':11A,14A '-2026':10A,13A 'cve':9A,12A 'handl':8A 'input':7A 'jettab':1A 'plugin':3A 'store':4A 'wordpress':2A 'xss':5A","search_b":"'attack':39B 'browser':50B 'content':26B,43B 'crocoblock':15B,21B 'input':31B 'jettab':16B,19B 'neutral':29B 'page':37B 'plugin':23B 'run':45B 'script':46B 'store':42B 'tab':25B 'visitor':49B 'wordpress':18B,22B 'written':35B","search_c":"'2.3.5':79C 'affect':74C 'allow':70C 'crocoblock':65C 'cross':60C 'cross-sit':59C 'generat':58C 'improp':51C 'input':54C 'issu':73C 'jet':68C 'jet-tab':67C 'jettab':66C,75C 'n/a':77C 'neutral':52C 'page':57C 'script':62C 'site':61C 'store':71C 'tab':69C 'vulner':63C 'web':56C 'xss.this':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125835","severity":null,"published_at":"2026-11-13T15:17:42+00:00","modified_at":"2026-11-13T15:17:42+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","fetched_at":"2026-11-13T15:46:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}