What is the CVSS score of CVE-2026-54188?

CVE-2026-54188 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of JetEngine are affected by CVE-2026-54188?

JetEngine WordPress plugin versions 3.8.10 and earlier contain an unauthenticated cross-site scripting vulnerability enabling attackers to inject malicious code executable in users' browsers,…

How to fix or mitigate CVE-2026-54188?

Within 24 hours: Identify all WordPress instances running JetEngine and determine current plugin versions; disable the plugin immediately if it is not critical to operations. Within 7 days: For sites where the plugin cannot be disabled, implement Web Application Firewall (WAF) rules to block XSS payloads, deploy Content Security Policy (CSP) headers to restrict inline script execution, and enable two-factor authentication on all administrative accounts. Within 30 days: Monitor JetEngine project for security patch release (target version 3.8.11 or later); establish staging environment to validate patch before production deployment. Note: no public exploit identified at time of analysis, but vulnerability remains HIGH severity due to authentication-agnostic nature.

JetEngine CVE-2026-54188

EUVD-2026-37633 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

XSS Jetengine

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unauthenticated XSS requiring victim click (UI:R); injected script crosses into victim session origin so S:C with low C/I/A impacts typical of reflected/stored XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:56 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

AnalysisAI

Unauthenticated cross-site scripting in the JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject malicious scripts that execute in the browser of any user who interacts with a crafted link or page. The CVSS 7.1 score reflects the scope change inherent to XSS (attacker-supplied JavaScript runs in the victim's site origin), and no public exploit has been identified at time of analysis. Successful exploitation can lead to session hijacking, credential theft, or administrative account takeover on affected WordPress sites.

Technical ContextAI

JetEngine is a commercial WordPress plugin developed by Crocoblock (Jetimpex Inc.) used to build dynamic content, custom post types, listings, and meta fields - widely deployed alongside Elementor on business and membership sites. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is rendered into HTML output without sufficient encoding or sanitization. The CPE cpe:2.3:a:jetimpex_inc.:jetengine identifies all versions of the plugin up to and including 3.8.10 as vulnerable; because the issue is unauthenticated and reflective/stored in the browser context, it abuses the trust the WordPress front-end places in plugin-rendered content.

RemediationAI

Upgrade JetEngine to a version newer than 3.8.10 as published by Crocoblock - the exact fixed release is not specified in the input data, so consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-10-cross-site-scripting-xss-vulnerability for the confirmed patched version before deploying. If immediate upgrade is not possible, place the WordPress site behind a WAF with XSS rules tuned for WordPress plugin parameters (Patchstack, Wordfence, Cloudflare managed rules), restrict access to administrative URLs by IP where feasible, and enforce a Content-Security-Policy that disallows inline script execution on the affected pages - note that strict CSP can break Elementor/JetEngine preview functionality and admin tooling, so test in staging first.