What is the CVSS score of CVE-2026-49074?

CVE-2026-49074 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of JetEngine are affected by CVE-2026-49074?

JetEngine WordPress plugin versions 3.8.9.1 and earlier contain an unauthenticated cross-site scripting vulnerability; while no public exploit has been identified at time of analysis, the attack…

How to fix or mitigate CVE-2026-49074?

Within 24 hours: Inventory all WordPress installations and identify those running JetEngine plugin version 3.8.9.1 or earlier. Within 7 days: Apply compensating controls including Web Application Firewall rules, strict Content Security Policy headers, and restrict plugin access to administrators only; evaluate disabling the plugin if not critical. Within 30 days: Monitor vendor advisories for patch release, develop and test upgrade plan, deploy patched version immediately upon availability.

JetEngine CVE-2026-49074

EUVD-2026-37616 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

XSS Jetengine

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable WordPress plugin, no auth required, but victim must render payload (UI:R); XSS executes in browser context distinct from server (S:C) with limited C/I/A impact bounded by victim privileges.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:07 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

AnalysisAI

Unauthenticated reflected/stored cross-site scripting in the JetEngine WordPress plugin (versions <= 3.8.9.1) allows remote attackers to inject malicious script into pages rendered by the plugin, which then executes in the browser of any visitor who interacts with the crafted content. Successful exploitation enables session hijacking, credential theft, or administrative actions performed against logged-in WordPress users including site administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

JetEngine is a popular Crocoblock-developed WordPress plugin (CPE cpe:2.3:a:jetimpex_inc.:jetengine) used to build dynamic content, custom post types, listings, and meta fields on Elementor-based sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is rendered into HTML/JS contexts without adequate output encoding or input sanitization. Because JetEngine renders dynamic listings and form data into front-end templates, attacker-supplied payloads injected through unsanitized parameters are reflected or stored back into the DOM where the browser executes them in the origin of the WordPress site.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data - administrators should upgrade JetEngine to the latest release published by Crocoblock above 3.8.9.1 as soon as it is available and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-9-1-cross-site-scripting-xss-vulnerability for the exact fix version. As compensating controls until patching is complete, deploy a WAF rule (e.g., Patchstack, Wordfence, Cloudflare managed WordPress ruleset) to filter script/HTML payloads in JetEngine request parameters, enforce a strict Content-Security-Policy that disables inline scripts on the WordPress front end (note: may break Elementor widgets that rely on inline JS and require allowlisting), and require administrators to use separate browsers/sessions when authoring content to limit blast radius of an XSS payload executed in an admin session.