What is the CVSS score of CVE-2026-17019?

CVE-2026-17019 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-17019?

Yes, a public proof-of-concept exploit is available for CVE-2026-17019. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-17019?

Yes, a patch is available for CVE-2026-17019. Update the affected software to the latest version immediately.

JetEngine CVE-2026-17019

EUVD-2026-55034 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-10 WPScan

GHSA-g5mm-h736-h3g3

WordPress XSS Jetengine Unknown

6.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network upload with no complexity (PR:N, AC:L); scope change because XSS fires in victim browser; UI:R required as victim must open the SVG; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 20:31 vuln.today

CVSS changed

Aug 10, 2026 - 20:22 NVD

6.1 (MEDIUM)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 06:00 cve.org

MEDIUM 6.1

DescriptionCVE.org

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).

AnalysisAI

Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains targeted rather than widespread at this time.

Technical ContextAI

SVG is an XML-based image format that natively supports embedded JavaScript via <script> tags and event handlers, making unsanitized SVG storage a well-known XSS vector (CWE-79: Improper Neutralization of Input During Web Page Generation). JetEngine is a Crocoblock WordPress plugin used for building dynamic content, custom post types, and listing grids. The vulnerability arises from two compounding failures: the absence of SVG sanitization (e.g., stripping script nodes before storage) and missing upload authorization checks. The CVSS scope change (S:C) accurately reflects that execution occurs in the victim's browser context, outside the server's trust boundary. CPE: cpe:2.3:a:unknown:jetengine:*:*:*:*:*:*:*:* covers all versions below 3.8.13.1.

RemediationAI

Upgrade JetEngine to version 3.8.13.1 or later, which is confirmed as the patched release per the WPScan advisory at https://wpscan.com/vulnerability/355ea90d-9fb3-4dc6-9676-48e5255fbc77/. If immediate patching is not possible, restrict SVG uploads at the server or WAF level by blocking multipart/form-data requests containing SVG MIME types or .svg extensions to JetEngine upload endpoints - note this disables SVG upload functionality entirely. Alternatively, restrict access to the affected upload endpoints to authenticated users only via a WAF rule or WordPress capability check, mitigating the unauthenticated upload vector while leaving authenticated SVG uploads intact (though authenticated SVG XSS would remain a risk until patched). WordPress-level SVG sanitization plugins such as Safe SVG can be installed as a compensating control but should not replace patching.