JetSmartFilters CVE-2026-110890

Requires an authenticated WordPress user holding at least a low-privileged role (CVSS PR:L - e.g. contributor/author) who can submit input into a JetSmartFilters-handled field or filter configuration that is improperly neutralized before web page generation. Exploitation further requires victim user interaction (UI:R): a higher-privileged user such as an administrator must view the page or output where the stored payload renders, at which point the script executes in that victim's browser. Limiting factors: the attacker cannot be fully unauthenticated, the payload only triggers on victim page view (not automatically), and impact is confined to the affected site's authenticated users. This is not remotely exploitable against default configurations without a valid account on the target site.

This is a moderate-severity Stored XSS (CWE-79) in the Crocoblock JetSmartFilters WordPress plugin (≤3.8.6), scored CVSS 6.5 via vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The attack vector is network and complexity is low, but two signals meaningfully constrain real-world risk: PR:L requires an authenticated account with at least low privileges (per the vector, this is an authenticated flaw, not unauthenticated), and UI:R requires a victim to view the injected content. The scope change (S:C) reflects that injected script executes in a victim's browser context rather than the plugin's own, which is standard for stored XSS. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active exploitation or automated weaponization - the exploitation status is best characterized as no public exploit identified at time of analysis. Net assessment: this is a realistic but not urgent priority. It depends on an attacker already holding a contributor/author-tier account and on a privileged victim viewing the payload, which makes it more of a privilege-escalation-via-admin-session or defacement risk than a mass-exploitation threat. The A:L (availability) impact in the input vector is atypical for stored XSS and may be an over-assignment by the scoring source - verify against the actual payload behavior.

An attacker with a low-privileged authenticated WordPress account (e.g. contributor or author) injects a malicious JavaScript payload into a JetSmartFilters-controlled field or filter configuration that is not properly sanitized. The payload is stored and later executes in the browser of an administrator or other user who views the affected page or filter output, potentially hijacking the admin session or performing actions as that user. No public proof-of-concept was provided in the intelligence set.