JetSmartFilters EUVD-2026-112911

Exploitation requires an authenticated WordPress user with at least low-level privileges (PR:L - e.g., contributor/author capable of submitting content the plugin stores) on a site running JetSmartFilters version n/a through 3.8.6.2. It further requires user interaction (UI:R): a second user, typically an administrator or visitor, must view the page where the stored payload is rendered for the script to execute. These two factors - valid credentials plus a victim viewing the content - are the primary limits on realistic exploitation. The exact feature, parameter, or filter input that stores the unsanitized payload is not described in the available sources.

This is a moderate-severity Stored XSS (CWE-79) in the Crocoblock JetSmartFilters WordPress plugin, scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The CVSS signals indicate a network-reachable, low-complexity flaw that nonetheless requires an authenticated contributor-level or higher account (PR:L) AND victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser context rather than the vulnerable server. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is provided beyond the Patchstack advisory - so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a real-but-non-emergency bug: the dual prerequisites (authentication plus user interaction) meaningfully limit mass exploitation, making this a patch-on-normal-cadence item rather than a drop-everything priority. Key missing data to note explicitly: there is no EPSS probability, no fixed-version statement in the supplied sources, and the exact injection point (feature/parameter) is not described, so the trigger mechanism cannot be confirmed from available data.

An attacker holding a low-privileged authenticated WordPress account (e.g., contributor or author) on a site running JetSmartFilters ≤3.8.6.2 submits input containing a malicious script payload that the plugin stores without proper neutralization. When an administrator or another user later views the page where that content is rendered (UI:R), the script executes in their browser session, potentially enabling session/cookie theft or actions in the victim's context. No public exploit code is identified at time of analysis, and the attack requires both valid credentials and a victim viewing the affected content.