CVE-2026-107867: JetProductTables Reflected XSS Vulnerability

CVE-2026-107867 Overview

CVE-2026-107867 is a reflected cross-site scripting (XSS) vulnerability in the Crocoblock JetProductTables WordPress plugin. The flaw affects all versions up to and including 1.2.4. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject arbitrary JavaScript that executes in the context of a victim's browser. Exploitation requires user interaction, typically clicking a crafted link. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation can lead to session hijacking, credential theft, and unauthorized actions performed in the context of an authenticated WordPress user, including administrators.

Affected Products

Crocoblock JetProductTables plugin for WordPress
Versions from n/a through 1.2.4
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2026-10-14 - CVE-2026-107867 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107867

Vulnerability Analysis

The vulnerability resides in how JetProductTables processes and reflects user-controlled input back into rendered HTML pages. The plugin accepts input parameters without applying adequate output encoding or sanitization before writing them into the response body. An attacker crafts a URL containing malicious JavaScript payloads. When a victim clicks the link, the payload executes in their browser under the trust context of the WordPress site.

The scope is marked as changed in the CVSS vector, meaning the vulnerable component can affect resources beyond its own security boundary. This behavior is typical of reflected XSS where injected scripts gain access to cookies, Document Object Model (DOM) elements, and session tokens of the hosting site.

Root Cause

The root cause is missing or insufficient output escaping of request parameters processed by the plugin. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for safe output rendering. The affected plugin paths do not apply these functions consistently before echoing user input into HTML contexts.

Attack Vector

Exploitation is network-based and requires no authentication. The attacker delivers a crafted URL to the victim through phishing, malicious advertising, or social engineering. When the victim loads the URL on a site running a vulnerable JetProductTables installation, the injected script executes. Attackers can steal authentication cookies, perform actions on behalf of administrators, redirect users to attacker-controlled infrastructure, or deliver secondary payloads.

See the Patchstack Vulnerability Advisory for additional technical references.

Detection Methods for CVE-2026-107867

Indicators of Compromise

Web server access logs containing request parameters with URL-encoded <script>, javascript:, onerror=, or onload= payloads targeting JetProductTables endpoints.
Unexpected outbound requests from browsers of users who visited WordPress pages rendered by the plugin.
Suspicious new administrator accounts or modified plugin settings following access to crafted URLs.

Detection Strategies

Inspect HTTP request logs for query parameters containing HTML tags or JavaScript event handlers directed at pages using the plugin.
Deploy a web application firewall (WAF) with reflected XSS rulesets to flag anomalous script fragments in request parameters.
Correlate referrer headers from phishing campaigns with user sessions that triggered subsequent privileged actions.

Monitoring Recommendations

Monitor WordPress audit logs for configuration changes, user role modifications, and plugin activity occurring after suspicious inbound traffic.
Enable Content Security Policy (CSP) reporting to capture violations caused by injected inline scripts.
Review browser error telemetry and client-side monitoring for execution of unexpected scripts on pages rendered by JetProductTables.

How to Mitigate CVE-2026-107867

Immediate Actions Required

Identify all WordPress installations running JetProductTables and verify the installed version.
Deactivate the plugin on affected sites until a patched version is applied.
Rotate authentication cookies and administrator credentials if exploitation is suspected.
Review user accounts and plugin configuration for unauthorized changes.

Patch Information

At the time of publication, the advisory lists affected versions through 1.2.4. Monitor the Patchstack Vulnerability Advisory and the Crocoblock vendor channels for a patched release and apply it as soon as it becomes available.

Workarounds

Deploy a web application firewall rule to block requests containing script tags or JavaScript event handlers directed at JetProductTables endpoints.
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Train administrators and editors to avoid clicking unsolicited links referencing their own WordPress site.
Restrict access to the WordPress admin interface by IP allowlisting where feasible.

bash

# Example WAF rule concept to block reflected XSS payloads in query strings
# ModSecurity-style pseudo-rule
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1007867,phase:2,deny,status:403,msg:'Possible XSS targeting JetProductTables (CVE-2026-107867)'"