EUVD-2026-63330
GHSA-4gp5-x437-73g9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network vector and no privileges confirmed; UI:R and S:C are standard for reflected XSS; A:N since server availability is unaffected by client-side script execution.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
AnalysisAI
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the JetEngine plugin installed and active in version 3.8.14.1 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 is driven primarily by the network attack vector, no privilege or authentication requirement, and scope change - all of which are real factors for this class of flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update the JetEngine plugin beyond version 3.8.14.1; the exact patched release version is not explicitly confirmed in the available data and should be verified via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-14-1-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for the latest stable release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: enumerate all WordPress installations running JetEngine and document their versions using automated scanning. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remo
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated atta
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Co
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8),
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or hig
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attacke
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inj
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote att
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authent
The JetEngine plugin for WordPress contains a SQL injection vulnerability in the listing_load_more AJAX action that allo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today