An improper neutralization of input during web page generation in the Crocoblock JetSmartFilters plugin allows stored cross‑site scripting. This flaw enables an attacker to inject malicious scripts that are rendered in browsers of visitors when the affected pages are served.

Crocoblock JetSmartFilters WordPress plugin, all versions up to and including 3.8.6.1.

The CVSS score of 6.5 indicates medium severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, suggesting no large‑scale exploitation is currently known. Based on the description, it is inferred that the attack vector involves supplying malicious input to filter fields that the plugin stores and later renders on the site, leading to a typical stored XSS attack.