271 matches found
CVE-2026-66581
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...
CVE-2026-66581
JetEngine plugin (Crocoblock) version 3.8.14.1 and earlier is vulnerable to unauthenticated reflected/stored XSS due to insufficient input sanitization. CVSS 7.1 HIGH. Upgrade to a patched version beyond 3.8.14.1; Patchstack advisory referenced. No exploitation evidence reported. Monitor for upda...
EUVD-2026-63330
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...
CVE-2026-66581 WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...
CVE-2026-66613
Unauthenticated Remote Code Execution RCE in JetEngine = 3.8.14 versions...
EUVD-2026-62375
Unauthenticated Remote Code Execution RCE in JetEngine = 3.8.14 versions...
CVE-2026-66613
JetEngine plugin ≤ 3.8.14 allows unauthenticated remote code execution. CVSS 9.8 (CRITICAL). PatchStack documented it. No exploitation evidence or fixed version provided in documents. Upgrade to latest plugin version as precautionary measure. Monitor vendor announcements for official patch release.
CVE-2026-66613 WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in JetEngine = 3.8.14 versions...
WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14...
CVE-2026-18202
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who...
EUVD-2026-62278
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who...
CVE-2026-18202 JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who...
CVE-2026-18202
JetEngine WordPress plugin versions before 3.8.14 add SVG to the site-wide list of allowed upload types without sanitising file contents. This allows users with the upload files capability (e.g., Authors) to upload an SVG file containing malicious JavaScript, resulting in a Stored Cross-Site Scri...
PT-2026-78331
Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.15 Description An unauthenticated remote code execution RCE flaw exists, allowing an attacker to execute arbitrary code on the server without requiring authentication. Recommendations Update JetEngine to version...
CVE-2026-17019
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...
CVE-2026-17019 JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...
EUVD-2026-55034
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...
CVE-2026-17019
CVE-2026-17019 affects the JetEngine WordPress plugin prior to 3.8.13.1, where uploaded SVG files are not properly sanitized and upload permissions are insufficiently restricted. This allows unauthenticated attackers to upload a file containing malicious JavaScript that is stored on the server an...
CVE-2026-17019
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...