JetSmartFilters EUVD-2026-109738

Exploitation requires an authenticated account with at least low privileges (PR:L) capable of submitting input that JetSmartFilters stores and renders, plus a victim who subsequently loads the affected page (UI:R) for the stored payload to fire in their browser. The specific plugin feature, filter field, or parameter that carries the unsanitized input is not described in the available sources. Limiting factors that reduce real-world risk: it cannot be triggered by a fully unauthenticated attacker, it depends on victim interaction, and the direct technical impact is low (browser-context script execution, not server compromise). Affected: JetSmartFilters versions from n/a through 3.8.6.1.

This is a moderate-severity stored XSS (CVSS 6.5) in the JetSmartFilters WordPress plugin, and the signals point to a 'patch-this-month' issue rather than an emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates a network-reachable flaw that nonetheless requires an authenticated low-privileged account (PR:L) AND victim interaction (UI:R), which materially lowers real-world exploitability versus an unauthenticated drive-by. The scope change (S:C) and low-across-the-board impacts (C:L/I:L/A:L) are consistent with stored XSS executing in a victim's browser context rather than direct server compromise. The vuln.today decision label is 'this_month' (not act_now/emergency), it is NOT listed in CISA KEV, and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. The only reference is the Patchstack advisory database entry; this is a vendor advisory, not verified working exploit code. No signals conflict here - all point to a genuine but non-urgent, authenticated, interaction-dependent web vulnerability that should be remediated on a normal monthly patch cadence.

An attacker who holds a low-privileged authenticated account (e.g., contributor/author-level) injects a malicious script payload into a JetSmartFilters-controlled field that is stored and later rendered. When an administrator or other user views the affected page, the stored script executes in their browser session, potentially enabling session hijacking or actions in the victim's context. No verified public exploit code was identified at time of analysis; the only reference is the Patchstack advisory.