CVE-2026-107867

Deferred Deferred - Pending Action

Cross-Site Scripting in JetProductTables WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107867

EUVD

EUVD-2026-101015

Affected Vendors & Products

Vendor	Product	Version / Range
Crocoblock	JetProductTables	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Reflected Cross-site Scripting (XSS) vulnerability in the Crocoblock JetProductTables plugin for WordPress. It allows attackers to inject malicious scripts into web pages viewed by users. The issue occurs due to improper neutralization of user input during web page generation.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses JetProductTables plugin version 1.2.4 or earlier. Inspect web traffic for suspicious scripts in input fields or URLs. Use security tools like Wordfence or Patchstack to scan for XSS patterns. Monitor server logs for unusual activity.

Impact Analysis

Attackers could exploit this to steal visitor data, hijack user accounts, or perform other malicious actions. Successful exploitation requires a user to interact with a crafted link, page, or form submission. The impact includes potential data breaches and compromised user sessions.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations could face fines or penalties for failing to protect user data adequately.

Mitigation Strategies

Immediately update the JetProductTables plugin to version 1.2.4.1 or later. Apply Patchstack's mitigation rule if available. Remove unused plugins and themes. Restrict user privileges to minimize attack surface. Monitor for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-107867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70