Jettabs
Monthly
Stored cross-site scripting in the JetTabs WordPress plugin (Crocoblock / JetImpex Inc.) affects all versions up to and including 2.3.3.1 and allows an authenticated Contributor-level user to inject script that executes in the browser of a higher-privileged user who later views the affected tabs or accordion widget content. Because the injected payload only fires when an administrator, editor, or other privileged user renders the compromised content, exploitation is not automatic and requires the site to grant untrusted users Contributor accounts; the CVSS vector (PR:L, UI:R, S:C) reflects exactly that authenticated-plus-victim-interaction prerequisite. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the issue is best treated as a moderate-severity, low-real-world-priority hardening item for sites with open contributor registration.
Stored cross-site scripting in the JetTabs WordPress plugin (Crocoblock / JetImpex Inc.) affects all versions up to and including 2.3.3.1 and allows an authenticated Contributor-level user to inject script that executes in the browser of a higher-privileged user who later views the affected tabs or accordion widget content. Because the injected payload only fires when an administrator, editor, or other privileged user renders the compromised content, exploitation is not automatic and requires the site to grant untrusted users Contributor accounts; the CVSS vector (PR:L, UI:R, S:C) reflects exactly that authenticated-plus-victim-interaction prerequisite. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the issue is best treated as a moderate-severity, low-real-world-priority hardening item for sites with open contributor registration.