CVE-2026-18202

The JetEngine WordPress plugin before version 3.8.14 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the lack of sanitization when the plugin adds SVG to the site-wide list of allowed upload types. This allows users with upload capabilities, such as Authors , to upload file...

PT-2026-78292

Name of the Vulnerable Software and Affected Versions JetEngine WordPress plugin versions prior to 3.8.14 Description Insufficient sanitization of uploaded SVG files allows users with file upload capabilities, such as Authors, to upload files containing malicious JavaScript. This leads to Stored...