The CVE identifies an improper neutralization of input during web page generation in the JetMenu plugin, allowing an attacker to embed malicious scripts that run whenever a page containing the vulnerable menu is viewed. Because the payload is stored, the attack is persistent and can affect all users of the site. The weakness is a classic stored XSS, matching CWE‑79.

The vulnerability affects all installations of Crocoblock JetMenu up to and including version 3.0.5. Any WordPress site that has not yet updated to a patched release is at risk. No specific operating‑system or server requirements are indicated.

The CVSS score of 6.5 reflects a moderate impact. EPSS data is not available, so the likelihood of exploitation is uncertain, but stored XSS remains a common attack vector in WordPress sites. The vulnerability is not currently indexed in CISA’s KEV catalog. Attackers would typically inject a script via the menu configuration interface, which then renders in every page that shows the menu, enabling session hijacking or phishing attempts. The flaw is exploitable without any privileged access beyond the ability to edit a menu.