Improper neutralization of input during web page generation allows a DOM‑based XSS flaw in the JetTabs WordPress plugin. An attacker can inject and execute arbitrary JavaScript in the context of a site visitor's browser. This can lead to disclosure of session credentials, defacement, or execution of malicious code on the client side.

The JetTabs plugin from Crocoblock, versions up to and including 2.2.7, is affected. Sites running any of these plugin versions on a WordPress installation are vulnerable.

The CVSS score of 6.5 indicates a medium severity risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. No entry in the CISA KEV catalog indicates the flaw is not currently being actively exploited in the wild. The likely attack vector is remote, where an unauthenticated user can craft malicious input or URLs that the plugin processes without proper sanitization, leading to execution in the victim's browser.