The vulnerability is a case of Improper Neutralization of Input During Web Page Generation that allows an attacker to inject malicious JavaScript into the page’s DOM. The injected script is executed in the victim’s browser in the context of the legitimate site, giving an attacker the ability to steal cookies, hijack sessions, deface content, or perform unintended actions on behalf of the user.

The flaw exists in the Crocoblock JetTabs WordPress plugin for all releases from its earliest version through 2.2.9.1. Users running any JetTabs version equal to or older than 2.2.9.1 are affected.

The CVSS score of 6.5 classifies the issue as medium severity, and the EPSS score of less than 1% indicates a relatively low probability of exploitation in the general population. The likely attack vector is a user‑initiated interaction; based on the description, it is inferred that the attacker would need to convince a victim to load a page that contains maliciously crafted input that is reflected by the plugin into the DOM. Because the vulnerability is not listed in the CISA KEV catalog, the overall risk is moderate but not negligible. An attacker could supply a crafted URL or form input that feeds unfiltered data into the plugin’s rendering, causing the victim’s browser to execute attacker‑controlled code.