CVE-2026-107865

Executive Summary

CVE-2026-107865 is a stored cross-site scripting (XSS) vulnerability in the Crocoblock JetMenu WordPress plugin affecting versions through 3.0.5. The flaw stems from improper neutralization of user-supplied input during web page generation (CWE-79), allowing a low-privileged authenticated attacker to persist malicious script that executes in the browsers of other site users. With a CVSS base score of 6.5, successful exploitation can lead to session hijacking, credential theft, and unauthorized actions performed in the context of the victim's session.

Technical Analysis

The vulnerability resides in the JetMenu plugin, a Crocoblock extension for WordPress that provides mega-menu and dynamic menu-building functionality. Per the NVD description, the defect is an instance of CWE-79: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')." The specific variant is stored (persistent) XSS, meaning attacker-controlled input is stored server-side — likely in menu configuration or associated plugin data — and later rendered into a page without adequate output encoding or sanitization.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L provides useful constraints on the attack surface:

• AV:N (Network) — the vulnerable component is reachable over the network (the WordPress front end/admin interface).
• PR:L (Low privileges) — the attacker requires an authenticated account with low privileges (e.g., a contributor or author-level user, or any role with access to JetMenu configuration).
• UI:R (User interaction required) — a victim must view the page where the stored payload is rendered.
• S:C (Scope changed) — the vulnerable component and the impacted component are different security authorities, consistent with XSS executing in the victim's browser session.
• C:L / I:L / A:L — limited confidentiality, integrity, and availability impact.

Because only a low-privileged account is required and user interaction is needed, this is a classic stored XSS where an attacker with menu-editing capability injects a payload that detonates for higher-privileged viewers (e.g., administrators reviewing the menu) or for site visitors. The exact input field, parameter, or rendering template is not specified in the available advisory text; the precise sink is therefore not disclosed in the supplied data. No proof-of-concept, exploit code, or Nuclei template is publicly available as of this report.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (stored XSS) and the 3.0.5 influence range. No fabricated function names, parameters, or endpoints are asserted.

1. Reconnaissance / target identification. The attacker identifies WordPress sites running the JetMenu plugin at version 3.0.5 or earlier. Fingerprinting can be performed passively by inspecting page source for plugin asset references (e.g., paths under wp-content/plugins/jet-menu) or via Shodan queries for HTML containing JetMenu markers.

2. Triggering the flaw class. Using a low-privileged authenticated account with access to JetMenu configuration, the attacker supplies crafted input intended to be stored by the plugin. Because the plugin does not properly neutralize input during subsequent page generation (CWE-79), the malicious content is persisted and later rendered into a page without adequate output encoding.

3. Payload / execution method (class level). The attacker stores a script payload (for example, a <script> block or an event-handler attribute) within JetMenu-controlled data. When a victim — a site visitor or an administrator — loads the affected page, the browser executes the stored script in the context of that page's origin.

4. Post-exploitation impact. Script execution occurs in the victim's session scope. Typical outcomes for stored XSS include session/cookie theft, exfiltration of page content or CSRF tokens, redirection to attacker infrastructure, and performing privileged actions (such as creating an admin account) if an administrator is the victim. The CVSS scope-change (S:C) reflects impact that extends beyond the vulnerable component to the victim's browser and session.

Impact Assessment

The impact is confined to websites running Vulnerable JetMenu (≤ 3.0.5). Because JetMenu is a menu extension, affected sites likely expose the vulnerable rendering to public visitors, widening the victim pool. The CVSS subscores (C:L/I:L/A:L) indicate limited but non-trivial impact: an attacker can read or manipulate limited data, modify limited content, and cause minor availability effects within the victim's browser context. The PR:L / UI:R combination means the attacker needs a foothold account and must lure or wait for a victim to view the poisoned content. Blast radius includes any user (visitor or administrator) who renders the injected page; administrator compromise can escalate to full site takeover. No CISA KEV listing and no EPSS score are available, so real-world exploitation likelihood cannot yet be quantified from authoritative feeds.

Detection Guidance

Sigma Rule

title: Stored XSS Payload Stored via Crocoblock JetMenu (CVE-2026-107865)
id: 8f2c1a44-jetmenu-xss-2026
status: experimental
description: Detects suspicious script-like content submitted to JetMenu configuration endpoints, consistent with stored XSS.
logsource:
  product: wordpress
  service: web
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'jet-menu'
      - 'jetmenu'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'onmouseover='
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate administrative content containing script tags
level: medium
tags:
  - attack.t1189
  - cve.2026.107865

YARA Rule

rule CVE_2026_107865_JetMenu_Stored_XSS
{
    meta:
        description = "Detects script payloads associated with stored XSS in Crocoblock JetMenu (CVE-2026-107865)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-107865"
        severity = "medium"

    strings:
        $jetmenu = "jet-menu" ascii nocase
        $script1 = "<script" ascii nocase
        $script2 = "javascript:" ascii nocase
        $evt1 = "onerror=" ascii nocase
        $evt2 = "onload=" ascii nocase
        $evt3 = "onmouseover=" ascii nocase

    condition:
        $jetmenu and 1 of ($script*) or 1 of ($evt*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107865 Crocoblock JetMenu Stored XSS Attempt"; flow:established,to_server; http.uri; content:"jet-menu"; nocase; http.uri; content:"<script"; nocase; http.uri; content:"javascript:"; nocase; classtype:web-application-attack; sid:2026107865; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ http where url.path contains "jet-menu" or url.path contains "jetmenu" ]
  [ http where url.query contains "<script" or url.query contains "javascript:" or url.query contains "onerror=" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "(?i)jet-?menu")
| where match(uri, "(?i)(<script|javascript:|onerror=|onload=|onmouseover=)")
| stats count values(uri) as suspicious_uris by src_ip, host
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-107865">
  <rule id="107865" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>jet-menu</match>
    <regex type="pcre2">(?i)(&lt;script|javascript:|onerror=|onload=|onmouseover=)</regex>
    <description>CVE-2026-107865: Possible stored XSS submission to Crocoblock JetMenu</description>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because no patch is available through 3.0.5, restrict access to JetMenu configuration to trusted users only, applying least privilege and removing menu-editing capability from low-trust roles. Deploy a Web Application Firewall (WAF) with XSS filtering on plugin-related endpoints, and enforce a strict Content Security Policy (CSP) that disallows inline script execution to blunt stored payload delivery. Monitor and audit accounts capable of modifying menu content.

2. Patch / upgrade steps. No vendor fix is documented. Track Crocoblock's official JetMenu release channel for a version above 3.0.5 that addresses CVE-2026-107865. Until a fixed release is published, consider disabling the JetMenu plugin if menu functionality is non-critical, or substituting an alternative menu solution. Validate any claimed fix against a staging environment before production rollout.

3. Long-term hardening. Implement continuous vulnerability management and software composition tracking for WordPress plugins, enforce role-based access control, adopt Content Security Policy and output-encoding best practices at the theme/plugin layer, and maintain WAF rules for CWE-79 classes. Retain centralized web access logging to support retrospective compromise hunting.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107865
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• Crocoblock JetMenu plugin product page (vendor): https://crocoblock.com/plugins/jetmenu/
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• CVE record (CNA) for CVE-2026-107865: https://www.cve.org/CVERecord?id=CVE-2026-107865

No threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-107865 in available data, and the vulnerability is not listed in CISA KEV.