CVE-2026-28134

CVE-2026-28134 Exploitation Report JetEngine = 3.7.2 — Authenticated Contributor+ Remote Code Execution via Twig SSTI Date: March 11, 2026 CVSS Score: 8.8 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Plugin: JetEngine = 3.7.2 Plugin Slug: jet-engine CVE: CVE-2026-28134...

CVE-2025-67923

CVE-2025-67923 Exploitation Report JetEngine = 3.7.7 — Unauthenticated Stored Cross-Site Scripting via CCT REST API Date: March 11, 2026 CVSS Score: 7.1 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affected Plugin: JetEngine = 3.7.7 Plugin Slug: jet-engine Fixed In: 3.7.8 CVE:...

CVE-2026-125785

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1...

CVE-2026-125785

The Crocoblock JetEngine WordPress plugin (versions

CVE-2026-125785 WordPress JetEngine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1...

EUVD-2026-124150

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1...

WordPress JetEngine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetEngine versions = 3.9.1...

CVE-2026-125785: Crocoblock JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1...

VulnCheck KEV: CVE-2026-17019

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...

PT-2026-145634

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1...

CVE-2026-123477

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.0.2...

EUVD-2026-119218

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.0.2...

CVE-2026-123477

The Crocoblock JetEngine WordPress plugin (versions up to and including 3.9.0.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. This is caused by the Improper Neutralization of Input During Web Page Generation within the jet-engine component. An attacker could potentially in...

CVE-2026-123477 WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.0.2...

WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ayukiab in WordPress Plugin JetEngine versions = 3.9.0.2...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification vulnerability

Missing Authorization to Unauthenticated JetEngine Options Page Modification vulnerability discovered by andrea bocchetti in WordPress Plugin JetFormBuilder versions = 3.6.2...

CVE-2026-120561

The JetFormBuilder plugin for WordPress (all versions up to and including 3.6.2 ) is vulnerable to unauthorized data modification due to a missing capability check on the do_action function within the Update_Options action class. This flaw allows unauthenticated attackers to modify JetEngine Opti...

EUVD-2026-115666

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'doaction' function in the 'UpdateOptions' action class in all versions up to, and including, 3.6.2. This makes it possible for...

CVE-2026-120561 JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'doaction' function in the 'UpdateOptions' action class in all versions up to, and including, 3.6.2. This makes it possible for...

CVE-2026-39736

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1...