Jane Menu
Monthly
Unauthenticated stored cross-site scripting in the Jane Menu WordPress plugin before 1.5.1 lets remote attackers bind any published page to an attacker-controlled remote document that the plugin fetches and renders without escaping, causing arbitrary JavaScript to execute for visitors, including administrators. Authentication is not required, but exploitation is not automatic: the payload fires only when a victim visits the tampered published page (UI:R). Publicly available exploit code exists; CISA KEV does not list this CVE, and the independent assessment rates this as a genuine high-priority issue rather than an inflated score.
Unauthenticated stored cross-site scripting in the Jane Menu WordPress plugin before 1.5.1 lets remote attackers bind any published page to an attacker-controlled remote document that the plugin fetches and renders without escaping, causing arbitrary JavaScript to execute for visitors, including administrators. Authentication is not required, but exploitation is not automatic: the payload fires only when a victim visits the tampered published page (UI:R). Publicly available exploit code exists; CISA KEV does not list this CVE, and the independent assessment rates this as a genuine high-priority issue rather than an inflated score.