EUVD-2026-51929
GHSA-jv5v-wg25-69hq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L for mandatory Contributor role; S:C because payload executes in admin browser scope; UI:R as victim must navigate to the injected post; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.
AnalysisAI
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or higher to inject persistent malicious scripts via unescaped post meta values rendered by plugin shortcodes, with execution occurring in the browser context of higher-privileged users including administrators. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting limited observed mass exploitation at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold at minimum the WordPress Contributor role on the target site - this can be obtained via open registration, credential stuffing, or account compromise. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score, driven by PR:L and UI:R constraints, reflects a meaningful but bounded attack surface: exploitation requires an attacker to already hold a Contributor account on the target WordPress site, and a higher-privileged user must subsequently view the injected content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a Contributor-level account on a target WordPress site running JetEngine before 3.8.12, then creates or edits a post that includes a malicious JavaScript payload embedded in a post meta field rendered by a vulnerable JetEngine shortcode. When a site administrator reviews, previews, or visits the published post, the stored script executes silently in their browser, potentially exfiltrating the admin session cookie or issuing authenticated requests to create a rogue admin account. … |
| Remediation | Update JetEngine to version 3.8.12 or later, which applies the necessary output escaping to post meta values rendered by affected shortcodes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remo
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated atta
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Co
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8),
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attacke
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inj
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote att
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authent
Unauthenticated SQL injection in the JetEngine WordPress plugin versions up to 3.8.10.1 allows remote attackers to extra
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauth
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today