Crocoblock JetMenu EUVD-2026-97304

Exploitation requires an authenticated WordPress account with at least low-level content-authoring privileges (consistent with PR:L) able to submit input into a JetMenu field that is stored without proper output neutralization. Successful impact further requires a victim - typically an administrator or editor - to render/view the poisoned menu content (UI:R), at which point the stored script fires in their browser. Limiting factors: the attacker cannot be fully anonymous (some account access needed), a second privileged user must load the content, and sites that do not grant untrusted users authoring roles have a substantially reduced attack surface. Affected deployments are those running JetMenu 3.0.5 or earlier.

This is a stored Cross-Site Scripting (CWE-79) flaw in the Crocoblock JetMenu WordPress plugin (through 3.0.5), rated CVSS 6.5 (Medium) via CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vector indicates network-reachable, low-complexity exploitation but requires an authenticated low-privilege account (PR:L) and victim user interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in a different security context (a victim's authenticated browser session). No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no evidence of active exploitation - this is a typical Patchstack-reported WordPress plugin XSS rather than a high-priority emergency. The real-world risk is moderate and conditional: it depends on an attacker already holding a contributor/author-level account and an administrator subsequently viewing the poisoned content, which can escalate to admin session theft. Absence of EPSS/KEV/POC is expected for this class and is not itself a risk signal; the practical priority is standard patch-cycle remediation, elevated only where the site grants untrusted users content-authoring roles.

An attacker with a low-privilege authenticated WordPress account (e.g., contributor or author) injects a malicious JavaScript payload into a JetMenu field that is stored and later rendered. When an administrator or other privileged user views the affected menu/page in wp-admin, the script executes in their browser context, enabling session hijacking or admin-action forgery. No public exploit code is identified at time of analysis, but the AC:L vector makes crafting the payload straightforward.