JetSmartFilters
JetSmartFilters adds AJAX-powered filters for refining listings, products, posts, and other dynamic website content.
JetSmartFilters (jet-smart-filters) is a WordPress plugin with 8 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 9.3.
jet-smart-filtersCVE-2026-116857: JetSmartFilters: Stored cross-site scripting
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 3.8.6.2.
| Safe version |
|
||
|---|---|---|---|
| Oct 29, 2026 |
CVE-2026-116857
JetSmartFilters: Stored cross-site scripting
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 3.8.6.2.
|
3.8.6.3 |
CVE6.5
|
| Oct 26, 2026 |
CVE-2026-114708
JetSmartFilters: Stored cross-site scripting
JetSmartFilters <= 3.8.6.1 permits stored cross-site scripting: attacker-controlled content is persisted and later rendered without sufficient neutralization, allowing script to execute in a viewer’s browser under the affected site’s origin. The supplied CVSS vector requires a low-privilege authenticated attacker and victim interaction, but the export does not identify the minimum WordPress role, editable field, endpoint or rendering function. The resulting access is bounded by the viewing user’s browser context; an administrator victim or complete site takeover is not established.
|
3.8.6.2 |
CVE6.5
|
| Oct 15, 2026 |
CVE-2026-110890
JetSmartFilters: Cross-site scripting
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS. This issue affects JetSmartFilters: from n/a through 3.8.6. The CNA vector specifies an attacker with low privileges and requires victim interaction; the exact WordPress role is not identified for authenticated access. Attacker-controlled input is stored and later rendered without adequate output neutralization, allowing script execution in the site origin when the affected content is encountered. The export does not identify the vulnerable endpoint, action, parameter or function.
|
3.8.6.1 |
CVE6.5
|
| Jun 26, 2026 |
CVE-2026-56067
JetSmartFilters: SQL injection
JetSmartFilters is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.8.3.
|
3.8.3.1 |
CVE9.3
|
| Jun 17, 2026 |
CVE-2026-48875
JetSmartFilters: SQL injection
JetSmartFilters is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.8.1.
|
3.8.1.1 |
CVE9.3
|
| Aug 20, 2025 |
CVE-2025-54008
JetSmartFilters: A security weakness
JetSmartFilters is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
|
| Jul 16, 2025 |
CVE-2025-54009
JetSmartFilters: Cross-site scripting
JetSmartFilters is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
|
| Mar 31, 2025 |
CVE-2025-30963
JetSmartFilters: Cross-site scripting
JetSmartFilters is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
|