JetReviews CVE-2026-94667

Exploitation requires an authenticated account with privileges to submit JetReviews review content (consistent with PR:L), plus a victim who subsequently views the page where the stored payload is rendered (UI:R). It therefore does NOT work against a site that disallows untrusted user accounts or review submissions, and it does not fire until a victim loads the affected review page. The limiting factors are: mandatory authentication (low-privilege, not anonymous), mandatory victim interaction, and installation of the JetReviews plugin at version 3.1.2 or earlier on WordPress.

This is a moderate-severity Stored XSS (CWE-79) in the Crocoblock JetReviews WordPress plugin, scored CVSS 6.5 by Patchstack with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The low-privilege requirement (PR:L) indicates the attacker must be an authenticated user - typically a contributor/author-level account able to submit review content - and user interaction (UI:R) is required, meaning a victim (often an administrator or visitor) must view the page where the payload is stored. The scope change (S:C) reflects that injected script executes in the victim's browser context rather than the plugin's own, which is standard for stored XSS. No exploitation-probability signal is available: EPSS is not provided, the CVE is NOT in CISA KEV, and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis'. Because active-exploitation and probability data are entirely absent, risk prioritization rests solely on the CVSS vector. The combination of required authentication plus required victim interaction materially lowers real-world urgency compared to an unauthenticated network flaw, making this a real but second-tier issue: patch in routine cycles unless the site allows untrusted user registration or low-trust content contributors, in which case urgency rises. The only reference is the Patchstack database entry; no independent vendor advisory confirming a fixed version was supplied.

An authenticated low-privilege user (e.g., a contributor or a user permitted to submit reviews) injects a malicious JavaScript payload into a JetReviews review field, which the plugin stores without proper neutralization. When an administrator or other visitor later views the page rendering that review, the script executes in their browser session, enabling session/cookie theft or actions performed as the victim. No public exploit code is referenced, so exploitation would require an attacker to craft the payload independently.