Jetsmartfilters
Monthly
Unauthenticated SQL injection in the JetSmartFilters WordPress plugin (versions ≤ 3.8.1) allows remote attackers to inject arbitrary SQL queries against the underlying WordPress database without any authentication or user interaction. The CVSS 9.3 score reflects a scope-changing flaw with high confidentiality impact and low availability impact, and no public exploit has been identified at time of analysis. The vulnerability was disclosed via Patchstack and affects a popular Crocoblock/JetImpex filtering plugin widely deployed on WordPress sites.
Stored cross-site scripting (CWE-79) in the Crocoblock JetSmartFilters WordPress plugin, affecting versions through 3.8.6.2, allows an authenticated user with low-level privileges to persist script-bearing input that executes in the browser of a different user who later views the affected page. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation requires valid low-privileged credentials plus a victim viewing the stored content, with impact scoped beyond the vulnerable component. No CISA KEV listing and no public exploit code were identified at time of analysis; the vendor-reported issue is tracked as a this-month priority and detailed in Patchstack's advisory.
Stored cross-site scripting in the Crocoblock JetSmartFilters WordPress plugin, affecting versions through 3.8.6.1, lets an authenticated low-privileged user persist script content that later executes in another user's browser when the affected page is loaded. The CVSS 3.1 score of 6.5 includes a scope change (S:C), reflecting that the injected script runs in the victim's browser session rather than in the server's security context. No CISA KEV entry and no public exploit code were identified at the time of analysis, and the issue is prioritized for patching this month rather than treated as an emergency.
Stored cross-site scripting (XSS) in the Crocoblock JetSmartFilters WordPress plugin through version 3.8.6 lets an authenticated low-privileged user (CVSS PR:L, e.g., contributor or author) inject a persistent payload into filter-handled input that is improperly neutralized before web page generation, and the script then executes in the browser of a higher-privileged victim such as an administrator who views the affected page (UI:R). The issue is scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), is a moderate-severity CWE-79 defect, and there is no public exploit code or confirmed active exploitation identified at time of analysis; it is not exploitable against a default site without a valid account on the target WordPress installation.
Unauthenticated SQL injection in the JetSmartFilters WordPress plugin (versions ≤ 3.8.1) allows remote attackers to inject arbitrary SQL queries against the underlying WordPress database without any authentication or user interaction. The CVSS 9.3 score reflects a scope-changing flaw with high confidentiality impact and low availability impact, and no public exploit has been identified at time of analysis. The vulnerability was disclosed via Patchstack and affects a popular Crocoblock/JetImpex filtering plugin widely deployed on WordPress sites.
Stored cross-site scripting (CWE-79) in the Crocoblock JetSmartFilters WordPress plugin, affecting versions through 3.8.6.2, allows an authenticated user with low-level privileges to persist script-bearing input that executes in the browser of a different user who later views the affected page. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation requires valid low-privileged credentials plus a victim viewing the stored content, with impact scoped beyond the vulnerable component. No CISA KEV listing and no public exploit code were identified at time of analysis; the vendor-reported issue is tracked as a this-month priority and detailed in Patchstack's advisory.
Stored cross-site scripting in the Crocoblock JetSmartFilters WordPress plugin, affecting versions through 3.8.6.1, lets an authenticated low-privileged user persist script content that later executes in another user's browser when the affected page is loaded. The CVSS 3.1 score of 6.5 includes a scope change (S:C), reflecting that the injected script runs in the victim's browser session rather than in the server's security context. No CISA KEV entry and no public exploit code were identified at the time of analysis, and the issue is prioritized for patching this month rather than treated as an emergency.
Stored cross-site scripting (XSS) in the Crocoblock JetSmartFilters WordPress plugin through version 3.8.6 lets an authenticated low-privileged user (CVSS PR:L, e.g., contributor or author) inject a persistent payload into filter-handled input that is improperly neutralized before web page generation, and the script then executes in the browser of a higher-privileged victim such as an administrator who views the affected page (UI:R). The issue is scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), is a moderate-severity CWE-79 defect, and there is no public exploit code or confirmed active exploitation identified at time of analysis; it is not exploitable against a default site without a valid account on the target WordPress installation.