JetProductTables EUVD-2026-101015

Exploitation requires an unauthenticated attacker to craft a URL whose parameter is reflected by JetProductTables without proper output neutralization, and then requires a victim (ideally a privileged/logged-in WordPress user) to click that crafted link - this user-interaction requirement (UI:R) is the primary limiting factor. The flaw affects JetProductTables versions from the earliest release through 1.2.4 running on WordPress; sites on later patched versions are not affected. Impact is realized in the victim's browser session rather than on the server, so the practical blast radius depends on luring a user with meaningful site privileges. Because it is reflected (not stored), the payload is not persisted and each exploitation attempt needs a fresh delivered link.

This is a reflected cross-site scripting (CWE-79) flaw in the Crocoblock JetProductTables WordPress plugin (versions up to and including 1.2.4), reported by Patchstack with a CVSS 3.1 base score of 7.1. The vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates a network-reachable, low-complexity, unauthenticated issue whose severity is inflated primarily by the changed scope (S:C) typical of Patchstack XSS scoring; the actual impacts are only Low across confidentiality, integrity, and availability. Crucially, exploitation is gated by UI:R - a victim must be lured into clicking an attacker-crafted URL - which places this firmly in the targeted/social-engineering category rather than mass-automatable exploitation. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Overall this is a moderate, below-top-priority issue: real but reflected (not stored/persistent), requiring user interaction, and lacking any exploitation-probability or in-the-wild signal. SSVC-style framing: exploitation=none observed, automatable=no (reflected XSS needing per-victim interaction), technical impact=partial. Patch promptly in normal cycles rather than as an emergency.

An attacker crafts a URL containing a malicious script payload in a parameter processed by JetProductTables and reflected without proper neutralization, then delivers it to a logged-in site user or administrator via phishing or a malicious link. When the victim clicks, the script executes in their browser session in the context of the WordPress site, enabling session/cookie theft, forced admin actions, or page manipulation. No public POC is referenced, and exploitation requires the victim to click the crafted link (UI:R), limiting it to social-engineering-driven, targeted attacks.