WordPress Jaroti theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

An attacker exploiting this Reflected XSS vulnerability can inject arbitrary JavaScript code into a user's browser when they visit a specially crafted URL. This malicious script can then perform actions on behalf of the user, such as stealing cookies containing session tokens, redirecting the user to a phishing site, or modifying the content of the page. The potential impact is significant, as successful exploitation could lead to complete account takeover and unauthorized access to sensitive data. The blast radius extends to all users who interact with the affected plugin, particularly those who click on malicious links.

Websites using the Jaroti plugin, particularly those with user-facing forms or features that accept user input without proper sanitization, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r "<script>" /var/www/wordpress/wp-content/plugins/jaroti/

• generic web:

curl -I https://example.com/?param=<script>alert(1)</script>

• wordpress / composer / npm:

wp plugin list --status=active | grep jaroti

• wordpress / composer / npm:

wp plugin update jaroti

1. 2026-03-25Disclosure

   disclosure

1. Reserviert2026-02-02
2. Veröffentlicht2026-03-25
3. Geändert2026-04-28
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2026-25304 is to immediately upgrade the Jaroti WordPress plugin to version 1.4.8 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include input validation and output encoding on user-supplied data within the plugin, as well as employing a Web Application Firewall (WAF) to filter out malicious requests containing XSS payloads. Monitor web server access logs for suspicious URL patterns containing JavaScript code. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via a URL parameter and verifying that it is properly sanitized.