EUVD-2026-51929
GHSA-jv5v-wg25-69hq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L for mandatory Contributor role; S:C because payload executes in admin browser scope; UI:R as victim must navigate to the injected post; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.
AnalysisAI
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or higher to inject persistent malicious scripts via unescaped post meta values rendered by plugin shortcodes, with execution occurring in the browser context of higher-privileged users including administrators. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting limited observed mass exploitation at time of analysis. The scope-change characteristic (S:C in CVSS) elevates the real-world impact: successful exploitation can lead to admin session hijacking or unauthorized privileged actions despite the medium base score.
Technical ContextAI
JetEngine is a WordPress plugin developed for dynamic content management, providing custom post types, meta fields, and rendering shortcodes. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to apply output escaping to post meta values before they are rendered within a JetEngine shortcode. WordPress contributor-level users have write access to post meta fields; without server-side sanitization or output escaping at render time, attacker-controlled data flows directly into DOM output. Affected scope per CPE is cpe:2.3:a:unknown:jetengine:*:*:*:*:*:*:*:*, covering all plugin versions below 3.8.12. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms a network-delivered, low-complexity stored payload that requires a victim interaction (admin page view) and causes a scope change into the privileged user's browser context.
RemediationAI
Update JetEngine to version 3.8.12 or later, which applies the necessary output escaping to post meta values rendered by affected shortcodes. This is a vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/7222601e-4f2b-4dfb-88aa-692a556f3e86/ and EUVD-2026-51929. If an immediate update is not feasible, restrict the Contributor role from creating or editing posts that leverage JetEngine shortcodes with post meta output - this limits the injection surface but reduces editorial capability for contributor-tier users. Additionally, restricting open contributor registration or enforcing multi-factor authentication on all contributor accounts reduces the likelihood of an attacker obtaining the required low-privilege access. Content security policy (CSP) headers can reduce the blast radius of XSS execution but should not be treated as a primary mitigation, as they do not prevent payload storage. Note that the vendor CPE lists the developer as 'unknown'; confirm the plugin identity and update channel via the official WordPress plugin repository.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remo
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated atta
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Co
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8),
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote att
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attacke
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inj
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authent
The JetEngine plugin for WordPress contains a SQL injection vulnerability in the listing_load_more AJAX action that allo
SQL injection in JetEngine WordPress plugin (≤3.8.6.1) via Custom Content Type REST API allows unauthenticated remote at
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today