CVE-2026-94667

Executive Summary

CVE-2026-94667 is a stored cross-site scripting (XSS) vulnerability in the Crocoblock JetReviews WordPress plugin, affecting versions through 3.1.2. An authenticated attacker with low privileges can inject malicious script into review content, which is then executed in the browser of any user viewing the affected page. Successful exploitation can lead to session hijacking, credential theft, or arbitrary actions in the context of the victim's browser.

Technical Analysis

The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). JetReviews is a WordPress plugin that allows site visitors and authenticated users to submit reviews. The flaw resides in the handling of user-supplied review input, which is stored and later rendered without adequate output encoding or sanitization. Because the malicious payload is persisted in the application's database, it constitutes a stored (persistent) XSS rather than a reflected one.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates:

• Attack Vector: Network (remotely exploitable)
• Attack Complexity: Low (no special conditions required)
• Privileges Required: Low (attacker must have an account or ability to submit a review)
• User Interaction: Required (victim must view the compromised page or review)
• Scope: Changed (the vulnerable component impacts resources beyond its security scope)
• Confidentiality, Integrity, Availability: Low impacts across all three

The "Scope: Changed" metric reflects that the injected script executes in the context of the victim's browser session, potentially affecting resources outside the review component itself. The low privileges required suggest that any authenticated user with review submission rights—or potentially unauthenticated visitors if the site allows guest reviews—can be an entry point.

No public proof-of-concept, exploit code, or Nuclei template is currently available, and the vulnerability has not been added to CISA KEV. The technical details are derived from the NVD description, which explicitly identifies the plugin, the version ceiling, and the XSS class. No further code-level specifics (e.g., vulnerable parameter names or functions) are provided in the available intelligence; therefore, analysis remains at the vulnerability-class level.

Exploitation Scenarios

The attack chain for this stored XSS vulnerability follows a standard pattern for persistent client-side injection:

1. Reconnaissance and target identification: The attacker identifies a WordPress site running the JetReviews plugin version 3.1.2 or earlier. This can be done via Shodan dorks (e.g., http.html:"wp-content/plugins/jet-reviews") or by browsing the target site and locating a review submission form.

2. Triggering the flaw class: The attacker submits a review containing a malicious JavaScript payload. Because the plugin fails to properly neutralize input during web page generation, the payload is stored in the database without being escaped or sanitized. The exact submission endpoint or parameter name is not specified in the available description; however, the flaw is in the review content handling logic.

3. Payload execution method: When a victim (e.g., an administrator, moderator, or other site visitor) views the page where the review is displayed, the stored script executes in their browser. The payload could be designed to steal session cookies, perform actions on behalf of the user, or redirect to a malicious site. The "User Interaction: Required" metric confirms that a victim must view the tainted content.

4. Post-exploitation impact: Given the "Scope: Changed" and low integrity/confidentiality impacts, the attacker could hijack the victim's authenticated session, modify content, or initiate further attacks (e.g., drive-by downloads, phishing). If an administrator views the review, the attacker could potentially escalate to full site compromise by injecting malicious JavaScript that creates a new admin user or installs a backdoor plugin.

No public PoC is available; the attack chain is inferred from the vulnerability class and CVSS metrics. The absence of a known exploit does not reduce the risk, as stored XSS vulnerabilities are routinely exploited in the wild.

Impact Assessment

The business impact of CVE-2026-94667 includes:

• Session hijacking: Attackers can steal authenticated session tokens, leading to unauthorized access to user accounts, including administrative accounts.
• Data theft: Sensitive information displayed to the victim (e.g., personal data, private reviews) can be exfiltrated.
• Reputation damage: Defacement or malicious redirects can harm the site's reputation and user trust.
• Lateral movement: Compromised admin sessions can be used to install backdoors, modify site content, or pivot to other systems.

The CVSS score of 6.5 (Medium) reflects the need for user interaction and low privileges, but the "Scope: Changed" metric highlights the potential for broader impact beyond the vulnerable component. The blast radius includes all users who view the compromised review page, with the most severe consequences if an administrator is targeted. Given the popularity of JetReviews as a WordPress plugin, many sites may be exposed.

Detection Guidance

Sigma Rule

title: Stored XSS in JetReviews Plugin Review Submission
id: 3b8f2c1a-5d6e-4f7a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects potential stored XSS attempts via review submission in WordPress JetReviews plugin.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: web
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: 'jet-reviews'
    cs-uri-query|contains: 'review'
  keywords:
    - '<script'
    - 'javascript:'
    - 'onerror='
    - 'onload='
  condition: selection and keywords
falsepositives:
  - Legitimate review content containing HTML tags
level: medium

YARA Rule

rule CVE_2026_94667_JetReviews_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting Crocoblock JetReviews <= 3.1.2"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-94667"
        severity = "medium"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "javascript:" nocase
        $xss3 = "onerror=" nocase
        $xss4 = "onload=" nocase
        $plugin = "jet-reviews" nocase
    condition:
        $plugin and any of ($xss*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-94667 JetReviews Stored XSS Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"jet-reviews"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"javascript:"; nocase; classtype:web-application-attack; sid:1000001; rev:1; reference:cve,2026-94667;)

Elastic Detection

sequence by user.name
  [process where event.type == "start" and process.name == "php" and process.args : "*/jet-reviews/*"]
  [network where network.protocol == "http" and http.request.method == "POST" and http.request.body : "*<script*"]

Splunk SPL Query

index=web_logs sourcetype=access_combined
| search method=POST uri_path="*jet-reviews*"
| eval xss_indicator = if(match(request_body, "(?i)<script|javascript:|onerror=|onload="), 1, 0)
| where xss_indicator=1
| stats count by src_ip, uri_path, request_body
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100200" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>jet-reviews</url>
    <match>POST</match>
    <regex><script|javascript:|onerror=|onload=</regex>
    <description>CVE-2026-94667: Potential stored XSS attempt in JetReviews plugin</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_94667,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable or remove the JetReviews plugin if it is not essential.
   • If the plugin must remain active, restrict review submission to trusted users only (e.g., disable guest reviews).
   • Implement a Web Application Firewall (WAF) rule to block script tags and event handlers in review submissions.
   • Apply output encoding to all user-supplied content rendered on review pages via a custom WordPress filter.

2. Patch/upgrade steps:

   • No official patch is available as of this report. Monitor Crocoblock's official channels for a security update.
   • Once a patched version is released, upgrade JetReviews immediately. Verify the new version's changelog for XSS fixes.

3. Long-term hardening:

   • Adopt a secure software development lifecycle (SSDLC) that includes input validation and output encoding for all user-generated content.
   • Use Content Security Policy (CSP) headers to mitigate XSS impact.
   • Regularly audit WordPress plugins for vulnerabilities and remove unused components.
   • Implement least-privilege principles for user roles that can submit reviews.

References

1. NVD Entry for CVE-2026-94667: https://nvd.nist.gov/vuln/detail/CVE-2026-94667
2. Crocoblock JetReviews Official Page: https://crocoblock.com/plugins/jetreviews/
3. OWASP Stored XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
4. WordPress Plugin Security Best Practices: https://developer.wordpress.org/plugins/security/
5. CWE-79: Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html

No known threat actor campaigns or exploit-in-the-wild evidence is available at this time. The vulnerability has not been added to CISA KEV.