CVE-2026-85683 Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL

The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its...

CVE-2026-85683 Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL

The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its...

CVE-2026-85683

The Jane Menu WordPress plugin, in versions prior to 1.5.1 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is a lack of capability or nonce checks on a form handler accessible by unauthenticated users, which allows them to bind any published page to a remote ...