The vulnerability identified as CVE-2025-53987 affects Crocoblock JetMenu versions up to 2.4.11.1. It involves the insertion of sensitive information into data sent by the JetMenu component, allowing an attacker with privileges to retrieve embedded sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates that the attack can be performed remotely over the network with low complexity but requires some level of privileges. The impact is limited to confidentiality, with no integrity or availability effects. There is no vendor advisory or patch currently available, and no exploits are known to be in the wild.

An attacker with privileges can remotely retrieve sensitive information embedded in data sent by the JetMenu plugin, potentially leading to confidentiality breaches. There is no indication of impact on data integrity or availability. The vulnerability requires some level of privileges, limiting the attack surface to authorized users or compromised accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to privileged accounts and monitor for unauthorized access. Avoid exposing the vulnerable JetMenu versions in untrusted environments.