Jane Menu CVE-2026-85683

No authentication is required: the vulnerable form handler performs no capability or nonce check and is reachable by unauthenticated users (PR:N), who can bind any published page to a remote document of their choosing. The sole limiting factor is UI:R - exploitation payload only executes when a user (ideally an administrator) subsequently visits the affected published page; the attacker cannot force this visit directly. The plugin must be installed and at a version before 1.5.1, and the targeted page must be published. No other non-default configuration is required.

This is a genuine high-priority issue, not an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes an unauthenticated, network-reachable, low-complexity flaw, and the description confirms it: an unauthenticated form handler with no capability or nonce check lets anyone bind a published page to an attacker-controlled remote document whose unescaped head/body is then rendered - a classic unauthenticated stored XSS. The only gating factor is UI:R (a victim must visit the poisoned page), but because any visitor - explicitly including a logged-in administrator - triggers execution, the realistic outcome is admin-session hijack and full site takeover, which justifies the C:H/I:H/A:H impact. Public exploit code exists (WPScan), raising practical risk, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - exploitation status is 'exploit available' rather than 'exploited in the wild.' No SSVC decision data was supplied. Net: treat as a real, patch-promptly issue for anyone running the plugin, tempered by the plugin's likely small deployment footprint.

An unauthenticated attacker sends a crafted request to the vulnerable form handler, binding a popular published page to a remote HTML document they host that contains malicious JavaScript. When a site administrator (or any visitor) later loads that page, the injected script executes in their authenticated browser session, enabling cookie/session theft or creation of a rogue admin account. A public proof-of-concept is documented by WPScan.