Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-94667: JetReviews plugin can let attackers add scripts
CVE-2026-94667 · published 26 days ago
Summary
The JetReviews add‑on for WordPress, up through version 3.1.2, does not properly clean content that users submit. An attacker could place hidden code that runs in the browsers of anyone who views the affected page, potentially stealing data or hijacking sessions. Update the plugin to the latest release or remove it, and make sure any user‑generated content is validated before it is displayed.
What to do
- Update crocoblock jetreviews to version 3.1.2.1.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| crocoblock | jetreviews |
<= 3.1.2 Fix: upgrade to 3.1.2.1
|
Original advisory text
WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Oct 2026
Updated26 Oct 2026
First seen9 Oct 2026
Track software like this
Free during beta