Jane Menu WordPress Plugin: Unauthenticated Stored Cross-Site Scripting (CVE-2026-85683)

The Jane Menu plugin for WordPress versions prior to 1.5.1 fails to implement capability or nonce checks on a specific form handler. This flaw allows unauthenticated remote attackers to bind existing published pages to arbitrary external documents. When the plugin fetches and displays the content of these remote documents, it fails to sanitize or escape the output, resulting in Stored Cross-Site Scripting (XSS). This enables the execution of arbitrary JavaScript in the browser context of any visitor to the affected page, including authenticated administrators.

Impact

Successful exploitation leads to unauthorized JavaScript execution within the visitor's browser session. This can be used to perform actions on behalf of the user, steal session cookies, or facilitate further administrative compromise if an administrator visits the affected page.

Recommendation

• Update the Jane Menu plugin to version 1.5.1 or later immediately.
• Monitor WordPress web server logs for suspicious POST requests to the plugin's form handling endpoints, particularly those originating from unauthenticated sessions.
• Audit existing published pages on WordPress sites using this plugin to identify unauthorized document bindings.