EUVD-2026-53940
GHSA-4wv6-hfwf-hgxc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS with no auth and scope change warrants C:L and I:L, but no availability impact applies to standard client-side script injection.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.
AnalysisAI
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker does not require any authentication - the vulnerability is exploitable by any unauthenticated remote user (PR:N, AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score is driven primarily by the network attack vector (AV:N), no privilege requirement (PR:N), and scope change (S:C), reflecting genuine risk in environments where privileged WordPress users can be lured to interact with attacker-crafted links. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running JetEngine 3.8.13.1 or earlier, then crafts a URL containing a JavaScript payload injected into a vulnerable parameter processed by the plugin. The attacker delivers this URL to a site administrator or editor via phishing email or social media, and when the victim clicks the link while authenticated to the WordPress dashboard, the injected script executes in their browser - allowing the attacker to steal the session cookie, exfiltrate nonces, or silently perform administrative actions such as creating rogue admin accounts. … |
| Remediation | Update JetEngine to the first version released after 3.8.13.1 via the WordPress plugin dashboard or by downloading the latest release from the plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running JetEngine versions 3.8.13.1 and below through plugin audits and vulnerability scanning tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remo
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated atta
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Co
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8),
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or hig
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attacke
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inj
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote att
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authent
Unauthenticated SQL injection in the JetEngine WordPress plugin versions up to 3.8.10.1 allows remote attackers to extra
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today