EUVD-2026-81494
GHSA-3g5j-g3m3-wpqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account
-
DeliveryInject script into JetTabs widget field
-
ExploitStore unsanitized payload in post
-
ExecutionAdmin views affected content
-
ImpactScript executes in admin browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with at least Contributor-level privileges on a WordPress site running the JetTabs plugin version 2.3.3.1 or earlier (a Crocoblock/Elementor tabs and accordion widget addon). Exploitation is not fully automatic: the injected payload only fires when another user (typically an administrator or editor) subsequently views the content containing the JetTabs widget, so victim interaction (UI:R) is required. This limits realistic risk to sites that grant untrusted users Contributor accounts and where higher-privileged users then view attacker-authored content; it is not exploitable by fully unauthenticated attackers. |
| Impact | This is a moderate-severity, low-real-world-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes a network-reachable but authenticated (PR:L) stored XSS requiring victim interaction (UI:R); the scope change (S:C) reflects script executing in another user's browser context, which is standard for stored XSS and inflates the base score somewhat relative to actual impact (all impacts only Low). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. The key limiting factor - a Contributor-level account (PR:L) plus an admin/editor victim viewing the payload (UI:R) - makes this a privilege-escalation-within-CMS / insider-or-account-compromise scenario rather than a mass-exploitable flaw. Treat as routine patch-cycle priority, not emergency. No conflicting signals were found between the CVSS vector and the description (both consistent with an authenticated Contributor stored XSS). |
| Exploit ScenarioDerived | A user with a Contributor account on a WordPress site running JetTabs <= 2.3.3.1 injects a malicious script payload into a JetTabs widget field that is not properly sanitized. When a higher-privileged user (e.g., an administrator or editor) opens the affected post/page in the dashboard or front end, the stored JavaScript executes in their browser session, potentially enabling session hijacking or actions on their behalf. No public POC was identified at time of analysis, and exploitation requires both a valid low-privilege account and victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Stored cross-site scripting in the JetTabs WordPress plugin (Crocoblock / JetImpex Inc.) affects all versions up to and including 2.3.3.1 and allows an authenticated Contributor-level user to inject script that executes in the browser of a higher-privileged user who later views the affected tabs or accordion widget content. Because the injected payload only fires when an administrator, editor, or other privileged user renders the compromised content, exploitation is not automatic and requires the site to grant untrusted users Contributor accounts; the CVSS vector (PR:L, UI:R, S:C) reflects exactly that authenticated-plus-victim-interaction prerequisite. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the issue is best treated as a moderate-severity, low-real-world-priority hardening item for sites with open contributor registration.
RemediationAI
No vendor-released patch identified at time of analysis, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-3-3-1-cross-site-scripting-xss-vulnerability) and the Crocoblock JetTabs changelog for a version above 2.3.3.1 and apply it as soon as it is published; do not assume an unconfirmed fixed version number. Until then, the most effective compensating control is to deactivate the JetTabs plugin on sites that do not need it, accepting the loss of the Elementor tabs/accordion widget and possible layout breakage on pages that already use it, or to restrict its use to trusted, fully vetted authors. Where the plugin must stay enabled, tighten the WordPress role model: remove or suspend Contributor accounts that are not strictly necessary, downgrade untrusted users to Subscriber, require editorial approval before contributor content is published or previewed, and avoid opening untrusted contributor drafts in an administrator's or editor's authenticated session (trade-off: added editorial workflow overhead and delayed publishing). Virtual patching or XSS/WAF rules from a WordPress security vendor (for example Patchstack's or Wordfence's rule sets) can block common payload shapes at the request layer while a fix is pending, at the cost of false positives that may break legitimate rich-content submissions. A restrictive Content-Security-Policy that disallows inline script can reduce payload execution in the admin context but will likely break some WordPress admin and Elementor functionality, so test before enforcing it on production.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetTabs is a Crocoblock (JetImpex Inc.) add-on for the WordPress Elementor page builder that supplies tabbed-content and accordion widgets; the CPE entry cpe:2.3:a:crocoblock._jetimpex_inc.:jettabs:*:*:*:*:*:*:*:* identifies it as a standalone WordPress plugin without version constraints in the identifier. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting): user-supplied content accepted from a Contributor-level author is not sufficiently sanitized or escaped before being stored and re-rendered inside the JetTabs widget markup. The CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L vector maps to a network-reachable plugin endpoint, low attack complexity, an authenticated low-privileged (Contributor) attacker, mandatory victim interaction, and a scope change (S:C) because the script runs in the privileged user's WordPress admin context rather than the attacker's own low-privilege context - the classic driver of privilege-escalation-flavored XSS in WordPress. Contributing factors typical of this plugin class include a tab/accordion content-rendering path that trusts post meta or shortcode attributes and the WordPress role model, which permits Contributors to store content that others review.
Know when Jettabs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor account gives PR:L, stored XSS needs a victim to view content (UI:R), and script running in the victim's browser context justifies S:C with Low C/I/A.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB