Unknown Jetengine vulnerabilities

4 vulnerabilities

Known vulnerabilities in Unknown Jetengine, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.4CVE-2026-14864unknownjetengine+1
EPSS score
0.23%
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.7.2CVE-2026-17019unknownjetengine+1
EPSS score
0.27%
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).6.8CVE-2026-18202unknownjetengine+1
EPSS score
0.43%
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.8.8CVE-2023-1406crocoblockjetengine_for_elementor+2
EPSS score
1.52%
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.