Live › vulnerability › CVE-2026-85683
Go to dashboardJane Menu (WordPress plugin, about 200 active installs) before 1.5.1 has a store-config form handler with no capability or nonce check. An unauthenticated visitor can bind any published page to a remote document of their choosing. The plugin fetches that document and prints its head and body unescaped. The result is stored XSS in every visitor's browser, including admins. CVSS 8.8 (user interaction required). Found by Naoki Kawahigashi, coordinated by WPScan.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| jane-menu | wordpress | >= 0, < 1.5.1 | 1.5.1 |
wp plugin get jane-menu --field=version or open Plugins in wp-admin1.5.1 is vulnerable1.3.8 the plugin injects a tag with its version into the page head, so you can also view-source on a store-menu page1.5.1 or later (current release on wordpress.org)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-85683")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.