The JetMenu plugin for WordPress contains a flaw that permits sensitive information to be inserted into and subsequently exposed through data transmissions. This vulnerability, classified as CWE‑201, allows an attacker to retrieve confidential fields such as credentials or tokens that should remain hidden, potentially compromising the integrity and confidentiality of the site’s data.

Any WordPress installation using Crocoblock JetMenu version 2.4.11.1 or earlier is affected. The plugin’s support for all earlier releases means that any site that has not upgraded to 2.4.12 or later exposes itself to this flaw.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 percent shows that exploitation is unlikely but possible. The vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely exploit the flaw by accessing plugin‑rendered pages or by sending crafted requests to endpoints that cause JetMenu to output unfiltered data. No publicly known exploit code is available at this time, but the potential for accidental leakage remains.