EUVD-2026-81498
GHSA-7qjc-26f6-j79w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account
-
DeliveryInject XSS payload into JetSearch content
-
ExploitAwait admin/editor viewing content
-
ExecutionScript executes in privileged session
-
ImpactHijack session or perform admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with at least Contributor-level privileges (PR:L) on a site running the JetSearch plugin version 3.6.3 or earlier. Exploitation is not self-contained: it depends on required user interaction (UI:R) - a higher-privileged user such as an administrator or editor must view the attacker-supplied content for the stored payload to execute. These factors (low-trust authentication barrier plus dependence on victim action) meaningfully limit realistic exploitation despite the network attack vector. |
| Impact | This is a genuine but low-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L = 6.5 Medium) shows network reach and low complexity, but two factors substantially cap real-world risk: PR:L means the attacker must already hold an authenticated Contributor account, and UI:R means a higher-privileged user (typically an admin or editor) must view the poisoned content for the script to fire. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so this is not evidence of active or automatable exploitation. The scope change (S:C) is appropriate for stored XSS since the injected script executes in the victim's browser session rather than the vulnerable component's context. Net: a legitimate insider/low-trust-role escalation vector worth patching in normal cycles, not an emergency. Note the input lists no fixed version, so remediation guidance is currently incomplete and should be verified against the Patchstack advisory. |
| Exploit ScenarioDerived | An attacker who has registered or obtained a WordPress Contributor account submits post/widget content containing a malicious script payload through a JetSearch input that is not properly sanitized. When an administrator or editor later reviews or previews that content in wp-admin, the stored script executes in their authenticated browser session, potentially enabling session/cookie theft, admin actions, or account takeover. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Stored cross-site scripting in the JetSearch WordPress plugin (versions 3.6.3 and earlier, published by Crocoblock / Jetimpex Inc.) lets an authenticated user with Contributor-level access plant script-bearing content that executes in the browser of a higher-privileged user who later views it. The attack is unauthenticated only in the sense that no credential is needed by the ultimate victim: the attacker must first hold a low-trust WordPress account (CVSS PR:L), and successful execution depends on a separate admin or editor opening the injected page (UI:R), which keeps real-world exploitation limited. No public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS data was not supplied, so risk is best characterized as low-to-moderate with a scope-changing (S:C) impact on the affected site.
RemediationAI
No vendor-released patch identified at time of analysis: the published advisory covers JetSearch 3.6.3 and earlier, so administrators should check the Crocoblock/Jetimpex channel and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve) for a fixed release newer than 3.6.3 and apply it as soon as it is published; if a newer tagged version exists, upgrade to it and verify the plugin changelog explicitly names the XSS fix before considering the site covered. Until then, compensating controls are required, each with trade-offs: restrict or temporarily revoke Contributor-level and other low-trust roles on affected sites (the most effective control, but it may disrupt legitimate multi-author publishing workflows), audit and delete pending or published content and search-widget/shortcode settings created by low-privileged accounts (effective for removing planted payloads but manual and potentially incomplete), and deploy a web application firewall or content-security-policy rules that block inline and reflected script in plugin-generated search output (reduces exploitation likelihood but risks breaking legitimate plugin JavaScript and requires ongoing rule maintenance). As a last resort, deactivating JetSearch removes the attack surface entirely at the cost of losing on-site search functionality. Because the vector includes UI:R, educating editors and administrators not to open or preview untrusted Contributor submissions outside a sandboxed account also lowers exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetSearch is a search-enhancement plugin for WordPress from the Crocoblock/Jetimpex ecosystem, typically used alongside Elementor-based themes and page builders to provide AJAX-powered search widgets and results templates. The flaw is CWE-79 (improper neutralization of input during web page generation, i.e. cross-site scripting), and the Patchstack-sourced report classifies it as a Contributor-level XSS: user-supplied content that a Contributor can create is not correctly escaped or sanitized before being rendered, so it persists in the database and is emitted into a page viewed by another user. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L confirms a network-reachable, low-privilege-authenticated attack that requires victim interaction and crosses a privilege/security boundary (the changed scope reflects the ability to affect the more privileged viewing context rather than the attacker's own session). Affected code is tracked under CPE cpe:2.3:a:crocoblock._jetimpex_inc.:jetsearch:*:*:*:*:*:*:*:*, with EUVD-2026-81498 mirroring the vendor/plugin mapping for JetSearch up to and including 3.6.3.
Know when Jetsearch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor account needed (PR:L), admin must view content (UI:R), stored XSS executes in victim browser crossing scope (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Unauthenticated SQL injection in the JetSearch WordPress plugin (versions <= 3.5.17) allows remote attackers to inject a
Unauthenticated sensitive data exposure in Crocoblock JetSearch WordPress plugin (all versions through 3.6.1.2) permits
Exploit-DB