JetTricks CVE-2026-93618

Exploitation requires an authenticated WordPress account with at least low-privilege content-contribution rights (PR:L) on a site running JetTricks ≤2.0.1, plus a separate victim (typically an administrator or another logged-in user) who subsequently views the page where the malicious payload is stored (UI:R). The attacker injects the script into a JetTricks-controlled input that is persisted and later rendered without adequate output encoding. Limiting factors: the account requirement excludes purely anonymous attackers, and the stored payload only fires when a victim loads the affected content, so there is no fully automatic/unattended trigger. No non-default configuration is stated as required beyond having the plugin active.

This is a moderate, not high, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L = 6.5 MEDIUM) describes a stored XSS reachable over the network but gated by two real limiting factors: PR:L means the attacker must already hold an authenticated low-privilege account (typical of WordPress Contributor/Author roles that can submit content), and UI:R means a victim must load the page containing the persisted payload. The S:C (scope change) reflects script executing in a victim's browser session distinct from the vulnerable plugin's context, which is standard for XSS. No EPSS score, no CISA KEV listing, and no POC were provided in the intelligence, so there is no signal of automatable mass exploitation - no SSVC decision data was supplied either. The single Patchstack reference is a database advisory rather than a technical write-up or exploit. Net: a legitimately exploitable authenticated stored XSS worth patching, but with no evidence of active or automated exploitation and meaningful preconditions (account + victim interaction) that keep real-world urgency in the medium band. Note the A:L (availability) rating is questionable for an XSS with no described denial-of-service primitive; I would assess A:N.

An attacker with a low-privilege authenticated WordPress account (e.g. Contributor) on a site running JetTricks ≤2.0.1 injects a malicious script into a plugin-controlled field that is stored and rendered without proper output encoding. When an administrator or another user later views the page containing that content, the script executes in their browser session, enabling session/cookie theft or actions performed in the victim's authenticated context. No public exploit code was identified in the provided data, and successful execution depends on a privileged user viewing the poisoned content.