CVE-2026-94667 in JetReviews Plugin
Summary
by MITRE • 10/09/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The identified security flaw represents a classic instance of improper neutralization of input during web page generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests within the Crocoblock JetReviews plugin for WordPress, affecting versions ranging from n/a through 3.1.2. The core technical deficiency lies in the application's failure to adequately sanitize and validate user-supplied data before it is stored in the backend database and subsequently rendered back into HTML content without proper encoding. This lack of input validation allows an attacker to inject malicious client-side scripts, such as JavaScript, which are then permanently saved within the review entries or associated metadata fields managed by the plugin.
Unlike reflected XSS vulnerabilities that require a victim to click on a specially crafted link, this is classified as Stored Cross-Site Scripting because the malicious payload persists on the target server. When an authenticated user with sufficient privileges, such as an administrator or editor, submits a review containing script tags or event handlers like onload or onclick, the application accepts and stores this input without stripping out dangerous characters or encoding them into their HTML entity equivalents. Consequently, every time another user visits the page displaying these reviews, the browser executes the injected code in the context of the vulnerable website. This persistence makes the threat particularly severe as it does not rely on social engineering to trick a specific individual but rather affects all visitors who view the compromised content.
The operational impact of this vulnerability is significant and multifaceted. Attackers can exploit Stored XSS to steal session cookies, effectively hijacking user sessions and gaining unauthorized access to administrative accounts or other privileged areas of the WordPress installation. Beyond credential theft, the attacker can perform actions on behalf of the victim, such as modifying site settings, creating new administrator users, or defacing the website's appearance by injecting malicious HTML structures. In more sophisticated attack chains, this vulnerability serves as a foothold for further exploitation, potentially leading to full server compromise if combined with other vulnerabilities like Local File Inclusion or Remote Code Execution exploits that rely on file uploads managed through the same interface.
From an industry standards perspective, this flaw aligns directly with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The specific subtype here involves stored input where the application fails to neutralize special characters before storing them in a database or file system. In terms of offensive security frameworks, this vulnerability facilitates techniques categorized under MITRE ATT&CK ID T1059: Command and Scripting Interpreter, specifically JavaScript execution within a browser environment. It also supports lateral movement and credential access via T1078: Valid Accounts if the attacker uses stolen cookies to authenticate as an administrator.
Mitigation strategies must address both immediate remediation and long-term defensive coding practices. The primary and most effective solution is to upgrade the JetReviews plugin to version 3.1.3 or later, where Crocoblock has presumably implemented proper input sanitization and output encoding mechanisms. For organizations unable to update immediately due to compatibility constraints, a temporary workaround involves restricting who can submit reviews that contain HTML content by disabling rich text editors for untrusted users or implementing Web Application Firewall rules that detect and block common XSS payloads in POST requests targeting the review submission endpoints. Additionally, developers should enforce strict Content Security Policy headers on affected pages to mitigate the impact of any successful injection attempts by preventing unauthorized script execution from external domains.