CVE-2026-110890: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crocoblock JetSmartFilters

CVE-2026-110890 describes a stored cross-site scripting vulnerability in Crocoblock JetSmartFilters (jet-smart-filters) affecting versions from initial releases up to 3.8.6. The flaw is due to improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the context of the affected web application. This vulnerability can impact confidentiality, integrity, and availability as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).

Successful exploitation could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the affected application, potentially leading to partial confidentiality, integrity, and availability impacts. Stored XSS can result in session hijacking, defacement, or other malicious actions within the user's browser session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is provided in the input data, users should monitor Crocoblock's official channels for updates. Until a fix is available, consider applying input validation and output encoding workarounds if feasible.