CVE-2026-85683
Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL
- State
- Published
- Severity
- 8.8 High
- Published
- Oct 21, 2026
- Updated
- Oct 21, 2026
- Reserved
- Sep 4, 2026
Description
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | WPScan |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Jane MenuUnknown |
|
References
- https://wpscan.com/vulnerability/76cfadde-2db5-4e01-b44b-c399381c339b/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.