CVE-2026-107867: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crocoblock JetProductTables

The vulnerability identified as CVE-2026-107867 affects Crocoblock JetProductTables versions up to 1.2.4. It is a reflected cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that can be executed in the victim's browser, potentially leading to information disclosure, session hijacking, or other impacts. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, leading to potential information disclosure, modification of data, or disruption of service. The reflected XSS nature requires user interaction but can have significant consequences depending on the context of the injected script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, users should consider applying input validation or output encoding workarounds if feasible and monitor vendor communications for updates.