Executive brief
JetTabs is a WordPress plugin that provides tabbed content management functionality. The plugin is vulnerable to Cross Site Scripting (XSS) attacks, allowing an authenticated contributor-level user to inject malicious scripts that could steal visitor data or hijack user accounts. This requires a privileged user to perform an action like clicking a malicious link or submitting a crafted form.
Technical details
This is a stored or reflected Cross Site Scripting (XSS) vulnerability classified under OWASP A3 Injection. The vulnerability affects JetTabs versions up to 2.3.3.1 and requires a user with Contributor or higher privileges to initiate the attack. Successful exploitation requires user interaction, such as a victim clicking a malicious link or visiting a crafted page. An attacker can inject malicious scripts into the site that execute in visitors' browsers, potentially stealing session data or redirecting to phishing pages. The vulnerability is patched in version 2.3.3.2 and later.
Affected products
- Crocoblock JetTabs <= 2.3.3.1
Timeline
- 2026-09-17: disclosed: Reported and published by Patchstack
- 2026-09-17: patched: Patch available in version 2.3.3.2