PatchSiren

Jane Menu CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Jane Menu CVE published 2026-10-21

CVE-2026-85683

The Jane Menu WordPress plugin before 1.5.1 has a vulnerability allowing unauthenticated stored XSS via a store config proxy URL. This is possible because the plugin does not have capability or nonce checks on one of its form handlers, which can be accessed by unauthenticated users. They can bind any published page to a remote document of their choice. The plugin then fetches and outputs the head and body [truncated]