---
id: CVE-2026-85683
title: Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL
summary: >-
  The Jane Menu WordPress plugin before 1.5.1 does not have any capability or
  nonce checks on one of its form handlers, which is reachable by
  unauthenticated users, allowing them to bind any published page to a remote
  document of their cho…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-79
product: Jane Menu
affected:
  - jane_menu < 1.5.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-21T10:11:27.317655Z'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T10:14:54.800Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85683'
references:
  - url: 'https://wpscan.com/vulnerability/76cfadde-2db5-4e01-b44b-c399381c339b/'
tags:
  - cve.org
ingestedAt: '2026-10-21T09:46:15.398Z'
---

## Overview

The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.

## Affected

- `jane_menu < 1.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.