The vulnerability is a stored XSS flaw that occurs when input supplied to the JetSearch plugin is not properly neutralized before being rendered on a web page. An attacker can inject malicious JavaScript that is later displayed to users who view the affected pages, potentially allowing credential theft, defacement, or defacement of the site’s content. The weakness is classified as CWE‑79, a common input validation issue.

Crocoblock JetSearch is affected for all releases up to and including 3.5.10.1. The plugin is commonly used within WordPress installations, so any site that installs or is currently running JetSearch at version 3.5.10.1 or earlier is vulnerable.

The CVSS score of 6.5 indicates a moderate severity flaw. The EPSS score of less than 1% suggests low historical exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. However, because the flaw can be triggered via a normal web request to a stored value, an attacker who can inject content into the plugin’s input fields could gain the ability to run arbitrary client‑side code in the victim’s browser. The attack vector is likely through the plugin’s web form inputs or management interface, which allows arbitrary text to be stored and rendered on later page loads.