What is the CVSS score of CVE-2026-54189?

CVE-2026-54189 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of JetEngine are affected by CVE-2026-54189?

JetEngine WordPress plugin versions 3.8.10 and earlier contain an unauthenticated cross-site scripting vulnerability that allows attackers to inject malicious scripts affecting all site visitors,…

How to fix or mitigate CVE-2026-54189?

Within 24 hours: Inventory all JetEngine installations and identify which systems run versions 3.8.10 or earlier; document business criticality and affected user populations. Within 7 days: Disable JetEngine on non-critical systems; deploy Web Application Firewall rules to block XSS payloads at the perimeter; restrict administrative access to the plugin via IP allowlisting. Within 30 days: Establish a process to apply the patch immediately upon vendor release; evaluate alternative plugins to reduce dependency; audit access logs for indicators of exploitation.

JetEngine CVE-2026-54189

EUVD-2026-37634 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

XSS Jetengine

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-delivered XSS requiring a victim click; scope changes from plugin to WordPress origin, with limited C/I/A impact typical of script-in-browser execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:56 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

AnalysisAI

Reflected or stored cross-site scripting in the JetEngine WordPress plugin (versions 3.8.10 and earlier) allows remote unauthenticated attackers to inject arbitrary script that executes in a victim's browser after the user is lured to a crafted link or page. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 7.1 with scope change, reflecting impact on the WordPress session context beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

JetEngine is a widely deployed Crocoblock WordPress plugin (CPE cpe:2.3:a:jetimpex_inc.:jetengine) used to build custom post types, meta fields, dynamic listings, and Elementor/Bricks/Gutenberg widgets, meaning user-controlled input is rendered into many front-end and admin contexts. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where attacker-supplied data is reflected or stored into HTML/JavaScript output without sufficient encoding or sanitization. Because WordPress executes plugin output in the same origin as the site itself, injected script runs with the privileges of whichever user views the affected page, including logged-in administrators.

RemediationAI

Patch available per vendor advisory - upgrade JetEngine to the version released after 3.8.10 as listed on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-10-cross-site-scripting-xss-vulnerability-2); the exact fixed version is not independently confirmed in the input data, so verify against the Crocoblock changelog before deploying. As a compensating control until patching, place the site behind a WAF with XSS rule sets enabled (Patchstack/Wordfence virtual patching, Cloudflare Managed Rules) - this can break legitimate dynamic listings that embed HTML, so test in staging. Where JetEngine widgets are not strictly needed on public pages, restrict their use to authenticated editorial contexts and review existing dynamic content for stored payloads, accepting that this reduces the plugin's front-end functionality.