62 matches found
WordPress JetEngine plugin < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) vulnerability
Unauthenticated Stored XSS via Form File Upload SVG vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin JetEngine versions 3.8.13.1...
WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14.1...
EUVD-2026-55034
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...
CVE-2026-17019 JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...
CVE-2026-17019
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...
CVE-2026-28082
CVE-2026-28082 affects the WordPress JetEngine plugin up to version 3.8.13.1, describing an unauthenticated Cross Site Scripting (XSS) vulnerability. The connected sources confirm the vulnerability existence and affected product/version but do not provide concrete technical details such as the ex...
CVE-2026-28082 WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...
CVE-2026-14864
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...
EUVD-2026-51929
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...
PT-2026-67054
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...
CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...
CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...
CVE-2026-65467
CVE-2026-65467 corresponds to a Server Side Request Forgery (SSRF) vulnerability in the WordPress JetEngine plugin, affecting versions up to 3.8.11. The issue is described as SSRF in JetEngine
CVE-2026-56068
JetEngine WordPress plugin versions ≤ 3.8.10.2 are affected by an unauthenticated SQL injection vulnerability . The connected documents provide the vulnerability type and affected versions but do not include concrete technical details (vulnerable parameter/input, root cause specifics, nor a remed...
EUVD-2026-37618
Unauthenticated SQL Injection in JetEngine = 3.8.9.1 versions...
CVE-2026-49084
Unauthenticated SQL Injection in JetEngine 3.8.9.1 versions...
CVE-2026-54189
JetEngine WordPress plugin
CVE-2026-54188
CVE-2026-54188 affects the WordPress JetEngine plugin (versions <= 3.8.10). It describes an unauthenticated Cross Site Scripting (XSS) vulnerability in JetEngine