Jetmenu
Monthly
Stored cross-site scripting in Crocoblock JetMenu (a WordPress mega-menu builder plugin) through version 3.0.5 lets an authenticated user with low-level content-authoring privileges inject script that is persisted and later executed in the browser of a higher-privileged viewer such as an administrator or editor. The flaw is rated CVSS 6.5 (Medium) under CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting the need for a valid account (PR:L) and for a victim to render the poisoned menu content (UI:R), with scope change because the injected script runs in the victim's session context. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); risk is concentrated on sites that grant untrusted or low-privilege users menu/content authoring capabilities.
Stored cross-site scripting in Crocoblock JetMenu (a WordPress mega-menu builder plugin) through version 3.0.5 lets an authenticated user with low-level content-authoring privileges inject script that is persisted and later executed in the browser of a higher-privileged viewer such as an administrator or editor. The flaw is rated CVSS 6.5 (Medium) under CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting the need for a valid account (PR:L) and for a victim to render the poisoned menu content (UI:R), with scope change because the injected script runs in the victim's session context. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); risk is concentrated on sites that grant untrusted or low-privilege users menu/content authoring capabilities.