CVE-2026-18202

The JetEngine WordPress plugin (versions before 3.8.14 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin adds SVG to the site-wide allowed upload types without sanitizing the file contents. This allows users with the upload files capability, such as Authors...

PT-2026-78292

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who...