The flaw is an Improper Neutralization of Input During Web Page Generation that permits attackers to store malicious scripts via the JetSmartFilters plugin. A compromised user who views the affected content will have the script executed in their browser, potentially leading to session hijacking, data theft, or defacement. The weakness aligns with the CWE‑79 category of Cross‑Site Scripting.

WordPress sites running the Crocoblock JetSmartFilters plugin up to and including version 3.8.6 are affected. The vulnerability originates in all revisions from the initial release through 3.8.6.

The vulnerability carries a CVSS score of 6.5 and an EPSS score of less than 1%, indicating a moderate severity but very low likelihood of exploitation at present. It is not listed in the CISA KEV catalog, so there are no known widespread attacks. Exploitation requires an attacker to be able to insert data that the plugin will store and display. The typical attack path involves submitting a malicious filter configuration that is later rendered in site pages.