Skip to main content

JetEngine CVE-2026-17019

| EUVDEUVD-2026-55034 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-10 WPScan GHSA-g5mm-h736-h3g3
XSS WordPress Jetengine
6.1
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vuln.today AI
6.1 MEDIUM

Unauthenticated network upload with no complexity (PR:N, AC:L); scope change because XSS fires in victim browser; UI:R required as victim must open the SVG; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 10, 2026 - 20:31 vuln.today
CVSS changed
Aug 10, 2026 - 20:22 NVD
6.1 (MEDIUM)
Patch available
Aug 10, 2026 - 08:02 EUVD
CVE Published
Aug 10, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 10, 2026 - 06:00 cve.org
MEDIUM 6.1

DescriptionCVE.org

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).

AnalysisAI

Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send unauthenticated HTTP upload request
Delivery
Submit SVG with embedded JavaScript payload
Exploit
Plugin stores unsanitized SVG on server
Execution
Victim user opens or renders the SVG URL
Persist
JavaScript executes in victim's browser
Impact
Attacker exfiltrates session cookies or performs privileged actions
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required - the JetEngine upload endpoint does not enforce any authentication check, allowing unauthenticated HTTP requests to submit SVG files. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 6.1 Medium score is well-calibrated: AV:N/AC:L/PR:N reflects trivial network-based unauthenticated delivery, while UI:R correctly captures that a victim must open the malicious SVG for the payload to fire. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker submits a crafted SVG file containing a JavaScript payload (e.g., a cookie-stealing script or admin account creation hook) to a JetEngine upload endpoint on a public-facing WordPress site. The file is stored on the server without sanitization. …
Remediation Upgrade JetEngine to version 3.8.13.1 or later, which is confirmed as the patched release per the WPScan advisory at https://wpscan.com/vulnerability/355ea90d-9fb3-4dc6-9676-48e5255fbc77/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jetengine

View all
CVE-2026-66613 CRITICAL
9.8 Aug 19

Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated atta
CVE-2026-52706 CRITICAL
9.8 Jun 17

Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote

CVE-2026-49075 CRITICAL
9.8 Jun 17

PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Co
CVE-2021-41844 CRITICAL
9.8 Dec 15

Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8),
CVE-2026-14864 MEDIUM POC
5.4 Aug 02

Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or hig
CVE-2026-42774 CRITICAL
9.3 May 25

SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attacke
CVE-2026-54187 CRITICAL
9.3 Jun 17

Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to
CVE-2026-49084 CRITICAL
9.3 Jun 17

Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inj
CVE-2026-49076 CRITICAL
9.3 Jun 17

Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote att
CVE-2026-32355 HIGH
8.8 Mar 13

Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authent
CVE-2026-12360 HIGH
7.5 Jun 17

Unauthenticated SQL injection in the JetEngine WordPress plugin versions up to 3.8.10.1 allows remote attackers to extra
CVE-2026-28082 HIGH
7.1 Aug 06

Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauth

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-17019 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy