Jane Menu
Jane Menu has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Jane Menu has a vendor fix available, so running the current release closes it.
All of these findings were reported by Naoki Kawahigashi. Jane Menu is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-85683Jane Menu <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Jane Menu
Author
Jane Technologies
Jane is an eCommerce company that operates in the US and Canada. Our customers are stores, and our software connects to their POS systems, syncs in their product catalog, and creates an online storefront where end users can shop for products. When a user makes a purchase, we push data back to the POS system so that the customer can either pick up the order in-store or get their order delivered. This plugin allows our customers to easily deploy Jane menus into their websites External services This plugin displays a store menu provided by Jane, and uses Algolia to look up product details for page metadata. It does not work without them. Jane Jane runs the store menu this plugin embeds. When a visitor opens a page you have set up as a store menu, your site’s server requests the menu from the Proxy URL you entered in Store Configs, usually on api.iheartjane.com. The request is made on every such page view. It contains only that URL and standard request headers, which include your site’s address. The plugin sends no information about the visitor. On product pages (a URL containing /products/<id>/), your site’s server also requests the store’s public profile from Jane to fill the page’s og:site_name tag. The request contains the Jane store ID. When an administrator enters a Proxy URL on the Add New or Edit screen, your site’s server requests that URL to check that it matches the page’s path. The menu is Jane’s storefront application. It runs in the visitor’s browser and loads from Jane’s servers, so Jane receives what the visitor does in it, including browsing, cart, and checkout details such as the contact and order information they enter. The storefront may also load third-party services for fonts, analytics, advertising measurement, and payment processing, as described in Jane’s privacy policy. Jane terms of service: https://www.iheartjane.com/terms Jane privacy policy: https://www.iheartjane.com/privacy-policy Algolia Jane’s product catalog is served through Algolia’s search service. On product pages, your site’s server queries Algolia (algolia.net) for the product’s name, brand, description, and image, to set the page title and social sharing tags. The request contains the Jane store ID and product ID, and no information about the visitor. Algolia terms of service: https://www.algolia.com/policies/terms/ Algolia privacy policy: https://www.algolia.com/policies/privacy/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C