The JetTabs plugin in WordPress contains an improper neutralization of user input during web page generation, allowing an attacker to store malicious scripts that will execute when other users view affected pages. This stored XSS can lead to session hijacking, credential theft, or execution of arbitrary client‑side commands, compromising the confidentiality, integrity, and availability of the site for users. The weakness is an example of CWE‑79, Cross‑Site Scripting.

The vulnerability affects the Crocoblock JetTabs plugin for WordPress versions from the initial release through 2.2.9 inclusive. Any site using JetTabs in this version range is subject to exploitation until a newer version is installed.

The CVSS score of 6.5 indicates medium risk, while the EPSS score of less than 1% shows a low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed large‑scale exploitation has been documented. The likely attack vector involves an authenticated user with content‑management privileges inserting malicious code via the JetTabs interface, which is then stored and served to other visitors. Successful exploitation would require accessibility to the administrative interface and the ability to edit or create content with the vulnerable plugin.