What is the CVSS score of CVE-2026-28082?

CVE-2026-28082 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of JetEngine are affected by CVE-2026-28082?

JetEngine WordPress plugin versions 3.8.13.1 and below contain an unauthenticated cross-site scripting vulnerability that exposes any WordPress installation running the plugin to credential theft,…

How to fix or mitigate CVE-2026-28082?

Within 24 hours, identify all WordPress installations running JetEngine versions 3.8.13.1 and below through plugin audits and vulnerability scanning tools. Within 7 days, either remove the plugin entirely or-if operationally critical-implement Web Application Firewall rules to block XSS payloads and restrict plugin access to authenticated administrators only. Within 30 days, monitor vendor advisories for the patched release (version 3.8.14 or higher) and execute an immediate upgrade plan once available.

JetEngine CVE-2026-28082

EUVD-2026-53940 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-4wv6-hfwf-hgxc

WordPress XSS Jetengine Wordpress Plugin Crocoblock Jetimpex Inc

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS with no auth and scope change warrants C:L and I:L, but no availability impact applies to standard client-side script injection.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:19 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

AnalysisAI

Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.

Technical ContextAI

JetEngine is a feature-rich dynamic content and listing builder plugin for WordPress, developed by Crocoblock (JetImpex Inc.) and identified via CPE cpe:2.3:a:crocoblock._jetimpex_inc.:jetengine:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), which occurs when user-supplied input is reflected or stored in an HTML page without adequate encoding or sanitization, allowing arbitrary script execution in the victim's browser. The CVSS scope-change flag (S:C) indicates the injected script can operate beyond the vulnerable component itself - typically breaking out of the plugin's sandboxed output to affect the broader WordPress session context in the browser. The attack complexity is low (AC:L), meaning no race conditions or special configurations are required to trigger the flaw.

RemediationAI

Update JetEngine to the first version released after 3.8.13.1 via the WordPress plugin dashboard or by downloading the latest release from the plugin repository. The exact patched version number is not independently confirmed in the available input data - verify the current version on the WordPress plugin directory or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-13-1-cross-site-scripting-xss-vulnerability before upgrading. As an interim compensating control while patching is arranged, implement a strict Content-Security-Policy header (e.g., script-src 'self') to block inline script execution - note this may break other JavaScript-dependent features on the site and requires careful testing. Alternatively, a Web Application Firewall (WAF) rule blocking reflected script patterns in JetEngine-routed requests can reduce exposure but is not a substitute for patching. Restrict access to affected JetEngine endpoints to authenticated users only if the business logic permits, as the PR:N condition means unauthenticated visitors are the attack source.