{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jane-menu--1.5.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jane_menu:jane_menu:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-85683"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Jane Menu (\u003c 1.5.1)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Jane Menu"],"content_html":"\u003cp\u003eThe Jane Menu plugin for WordPress versions prior to 1.5.1 fails to implement capability or nonce checks on a specific form handler. This flaw allows unauthenticated remote attackers to bind existing published pages to arbitrary external documents. When the plugin fetches and displays the content of these remote documents, it fails to sanitize or escape the output, resulting in Stored Cross-Site Scripting (XSS). This enables the execution of arbitrary JavaScript in the browser context of any visitor to the affected page, including authenticated administrators.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to unauthorized JavaScript execution within the visitor's browser session. This can be used to perform actions on behalf of the user, steal session cookies, or facilitate further administrative compromise if an administrator visits the affected page.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Jane Menu plugin to version 1.5.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eMonitor WordPress web server logs for suspicious POST requests to the plugin's form handling endpoints, particularly those originating from unauthenticated sessions.\u003c/li\u003e\n\u003cli\u003eAudit existing published pages on WordPress sites using this plugin to identify unauthorized document bindings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T11:19:25Z","date_published":"2026-10-21T11:19:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jane-menu-xss/","summary":"The Jane Menu WordPress plugin prior to 1.5.1 contains a vulnerability allowing unauthenticated attackers to perform Stored Cross-Site Scripting via improper capability and nonce checks in a form handler.","title":"Jane Menu WordPress Plugin: Unauthenticated Stored Cross-Site Scripting (CVE-2026-85683)","url":"https://feed.craftedsignal.io/briefs/2026-10-jane-menu-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Jane Menu (\u003c 1.5.1)","version":"https://jsonfeed.org/version/1.1"}