JetReviews
JetReviews adds review and rating elements for displaying user feedback on WordPress websites.
JetReviews (jet-reviews) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Oct 09, 2026; the highest published CVSS base score is 7.5.
jet-reviewsCVE-2026-94667: JetReviews: Stored cross-site scripting
The supplied vector requires low privileges; the exact WordPress role is not identified. Attacker-controlled content can be saved and later rendered without sufficient neutralization, allowing script execution under the site's origin in a viewer's session. The export does not identify the input field, storage operation, rendering function, output context or victim role. Victim interaction is required by the vector. The vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: <= 3.1.2. The authoritative export identifies 3.1.2.1 as fixed for this CVE.
| Safe version |
|
||
|---|---|---|---|
| Oct 09, 2026 |
CVE-2026-94667
JetReviews: Stored cross-site scripting
The supplied vector requires low privileges; the exact WordPress role is not identified. Attacker-controlled content can be saved and later rendered without sufficient neutralization, allowing script execution under the site's origin in a viewer's session. The export does not identify the input field, storage operation, rendering function, output context or victim role. Victim interaction is required by the vector. The vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: <= 3.1.2. The authoritative export identifies 3.1.2.1 as fixed for this CVE.
|
3.1.2.1 |
CVE6.5
NVDPending
|
| Jul 13, 2026 |
CVE-2026-61975
JetReviews: A security weakness
JetReviews is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.0.1.
|
3.1.0 |
CVE5.3
NVDPending
|
| Jul 02, 2026 |
CVE-2026-57354
JetReviews: Cross-site scripting
JetReviews is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.0.0.1.
|
3.0.0.2 |
CVE6.5
NVDPending
|
| Oct 22, 2025 |
CVE-2025-49921
JetReviews: Filesystem traversal
JetReviews is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVDPending
|
| May 19, 2025 |
CVE-2025-39396
JetReviews: Filesystem traversal
JetReviews is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVDPending
|