The Jane Menu WordPress plugin, available prior to version 1.5.1, lacks capability or nonce checks on one of its form handlers. This endpoint can be accessed by unauthenticated users and allows them to bind any published page to a remote document URL of their choosing. The plugin then fetches the content of that document and injects its head and body directly into the target page without escaping user input. The result is an arbitrary JavaScript payload that runs in the browser of any visitor to the page, including administrators. This stored cross‑site scripting flaw is classified as CWE‑79.

All installations of the Jane Menu plugin with a version older than 1.5.1 are affected. The issue is confined to the plugin itself and does not involve WordPress core. Site operators who have deployed the plugin before the 1.5.1 release should verify the version they are running and update if necessary.

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score of less than 1% indicates a low probability of current exploitation, but the public nature of the form handler means that no special skills or access levels are required; an attacker can trigger the payload with a simple HTTP request. While the vulnerability is not yet listed in the CISA KEV catalog, the straightforward attack vector and potential for credential compromise or defacement warrant prompt remediation.