Jane Menu WordPress plugin: Unauthenticated stored XSS via proxy URL
Summary
The Jane Menu WordPress plugin before version 1.5.1 has a form handler without capability or nonce checks that is reachable by unauthenticated users. An attacker can bind any published page to a remote document of their choice, and the plugin outputs that document's head and body without escaping. This allows arbitrary JavaScript to run in the browser of any visitor to that page, including administrators.
Affected
- Jane Menu WordPress plugin, all versions before 1.5.1 (VulDB describes up to 1.5.0)
- The earliest vulnerable version is unknown.
Fixed in
- Version 1.5.1 (per WPScan and VulDB). The WordPress.org changelog for 1.5.1 could not be verified.
Workaround
- No vendor workaround found.
- Deactivate the plugin if it is not essential.
- Review published pages for unexpected remote content or script-like output until 1.5.1 is installed.
Exploitation
- Not listed in CISA KEV. CISA SSVC: exploitation none, automatable no.
- VulDB reports no available exploit.
- Whether a public proof of concept exists is unknown.
- No evidence of in-the-wild exploitation was found.
Our recommendation
- Update Jane Menu to version 1.5.1 or later on all sites and check for installations on older versions.
- Until patched, deactivate the plugin if not needed and limit administrator browsing of the public site.
- Monitor published pages for unexpected changes to their content.
- Plan around the CVSS score of 8.8 for sites with administrator accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- VulDB entry 424713 vuldb.com
- OpenCVE CVE-2026-85683 app.opencve.io
- Patchstack via Vulners vulners.com
- CISA SSVC notes (GitHub issue) github.com
- WordPress.com plugin page wordpress.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:16.
Original description (NVD)
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.