CVE-2026-18202

JetEngine WordPress plugin versions before 3.8.14 add SVG to the site-wide list of allowed upload types without sanitising file contents. This allows users with the upload files capability (e.g., Authors) to upload an SVG file containing malicious JavaScript, resulting in a Stored Cross-Site Scri...