CVE-2026-85683 Details
Description
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
A stored cross-site scripting vulnerability has been identified in the Jane Menu WordPress plugin, affecting versions prior to 1.5.1. The issue arises because the plugin's form handler, accessible to unauthenticated users, lacks proper capability and nonce checks. This vulnerability allows attackers to link any published page to a remote document of their choice. The plugin then retrieves this document and injects its head and body content into the page without proper escaping. As a result, an unauthenticated attacker could execute arbitrary JavaScript in the browser of any visitor to that page, including administrators.
Users are advised to update the Jane Menu WordPress plugin to version 1.5.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/76cfadde-2db5-4e01-b44b-c399381c339b/ | [email protected] | AdvisoryPartial ContentRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Jane Menu | < 1.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |