{"id":"CVE-2026-85683","kind":"vulnerability","aliases":["CVE-2026-85683"],"related":[],"title":"Jane Menu WordPress plugin: unauthenticated visitors can inject scripts into pages","description":"The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.","summary":"Jane Menu (WordPress plugin, about 200 active installs) before 1.5.1 has a store-config form handler with no capability or nonce check. An unauthenticated visitor can bind any published page to a remote document of their choosing. The plugin fetches that document and prints its head and body unescaped. The result is stored XSS in every visitor's browser, including admins. CVSS 8.8 (user interaction required). Found by Naoki Kawahigashi, coordinated by WPScan.","severity":"high","cvss":8.8,"epss":0.00276,"exploited":false,"exploited_at":null,"products":[{"name":"jane-menu","fixed":["1.5.1"],"affected":">= 0, < 1.5.1","ecosystem":"wordpress"}],"ecosystems":["wordpress"],"tags":["jane-menu","package","unauthenticated","wordpress","wordpress-plugin","xss"],"not_affected_if":["jane-menu-version-1.5.1-or-later","plugin-not-installed","version-1.5.1-or-later"],"how_to_check":"Run 'wp plugin get jane-menu --field=version' or open Plugins in wp-admin. Anything below 1.5.1 is vulnerable. Since 1.3.8 the plugin injects a tag with its version into the page head, so you can also view-source on a store-menu page. Also review the Jane Menu store configs (the Proxy URL per page) for entries you did not create, and check store-menu pages for unexpected script tags.","fix":"Update Jane Menu to 1.5.1 or later (current release on wordpress.org). If you cannot update, deactivate the plugin. Then remove any unknown store configs and check page content for injected scripts. If an admin visited an affected page, consider rotating sessions.","status":"open","published_at":"2026-10-21T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:21+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:33:21Z","model":"claude-haiku-5-5","output":{"fix":"Update the Jane Menu plugin to 1.5.1 or later.","reach":"internet","title":"Jane Menu WordPress plugin: unauthenticated visitors can inject scripts into pages","impact":"high","summary":"The Jane Menu WordPress plugin has a form handler with no permission or nonce checks, so anyone can attach a remote document to any published page. The plugin then outputs that document's head and body unescaped, letting an attacker run JavaScript in every visitor's browser, including administrators.","category":"package","who_cares":["wordpress","jane-menu"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs scripts in admin browsers, stealing sessions and taking over the site.","analyst_note":"Confirm the affected form handler and whether the plugin's default configuration exposes it; check the NVD entry and plugin changelog for 1.5.1.","how_to_check":"Check whether the jane-menu plugin is installed and its version (Plugins screen in wp-admin, or wp plugin get jane-menu).\nunknown","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.5.1-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00052,"input_tokens":2970,"output_tokens":446,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the exact vulnerable form handler and a detection method (plugin version check path or affected page binding) at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-85683 and the plugin's changelog.","search":"'-2026':13A,16A '-85683':14A,17A '1.5.1':40B,111C '200':36B '8.8':94B 'activ':37B 'admin':92B 'administr':182C 'allow':132C 'arbitrari':169C 'attack':166C 'bind':58B,135C 'bodi':79B,157C 'browser':90B,173C 'capabl':50B,116C 'check':53B,119C 'choos':68B,145C 'config':45B 'coordin':102B 'cve':12A,15A 'cvss':93B 'document':65B,73B,142C,151C 'escap':162C 'everi':87B 'fetch':71B,149C 'form':46B,124C 'found':98B 'handler':47B,125C 'head':77B,155C 'includ':91B,180C 'inject':8A 'instal':38B 'interact':96B 'jane':1A,19A,22B,31B,106C 'jane-menu':18A,21B 'javascript':170C 'kawahigashi':101B 'menu':2A,20A,23B,32B,107C 'naoki':100B 'nonc':52B,118C 'one':121C 'output':153C 'packag':24B 'page':11A,61B,138C,160C,179C 'plugin':4A,29B,34B,70B,109C,147C 'print':75B 'publish':60B,137C 'reachabl':128C 'remot':64B,141C 'requir':97B 'result':82B 'run':168C 'script':9A 'store':44B,84B 'store-config':43B 'unauthent':5A,25B,55B,130C,165C 'unescap':80B 'user':95B,131C 'visitor':6A,56B,88B,176C 'without':161C 'wordpress':3A,26B,28B,33B,108C 'wordpress-plugin':27B 'wpscan':104B 'xss':30B,85B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85683","severity":null,"published_at":"2026-10-21T09:17:08+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-85683:523","url":null,"severity":null,"published_at":"2026-10-23T23:48:45+00:00","modified_at":"2026-10-23T23:48:45+00:00","first_seen_at":"2026-10-23T23:48:45+00:00","fetched_at":"2026-10-23T23:48:45+00:00","note":"WPScan (researcher Naoki Kawahigashi) and CVE record: affected <1.5.1, fixed 1.5.1. The exact handler name is not public: WPScan holds the PoC until 2026-11-19. The title says the injection is via the store config Proxy URL. The 1.5.1 changelog does not mention this fix; the 1.5.0 entry says admin permission checks were strengthened, so I could not confirm which release closed the handler. No public PoC and no exploitation evidence found. X has 1 post, not pulled."},{"source":"epss","external_id":"CVE-2026-85683","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85683","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":2173,"url":"https://wpscan.com/vulnerability/76cfadde-2db5-4e01-b44b-c399381c339b/","title":"Jane Menu < 1.5.1 – Unauthenticated Stored XSS via Store Config Proxy URL (WPScan)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2174,"url":"https://wordpress.org/plugins/jane-menu/","title":"Jane Menu plugin page and changelog","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2179,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85683","title":"CVE Record CVE-2026-85683","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}