JetEngine CVE-2026-81760

The target WordPress installation must have the JetEngine plugin installed and active at version 3.8.14.2 or earlier. Active user interaction is mandatory - the victim must click or be redirected to a crafted URL (UI:R in the CVSS vector); the vulnerability cannot be triggered passively. No authentication is required on the attacker's side (PR:N in the CVSS vector). No non-default plugin configuration or special server setting is indicated as a prerequisite - any publicly accessible JetEngine-rendered page is potentially exposed. The primary exploitation limiter is the required social engineering step to deliver the malicious URL to a target with an active authenticated session; unauthenticated visitors can also be targeted but the impact is reduced without a valid session to hijack.

The CVSS 3.1 score of 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C is a fair representation of the risk envelope: no authentication is needed on the attacker's side, exploitation complexity is low, and the scope change correctly captures browser-level impact. The mandatory user interaction (UI:R) is the primary mitigating factor - reflected XSS cannot self-propagate and requires social engineering to deliver the malicious link. No EPSS score was provided, which limits probabilistic modeling of near-term exploitation likelihood. The absence of a CISA KEV listing and no confirmed POC code both suggest this has not been weaponized at scale as of analysis time, though reflected XSS flaws in WordPress plugins are a consistently targeted class in automated scanning campaigns. The realistic worst-case scenario is compromise of an authenticated administrator session, which would yield full site control - making this a genuine remediation priority for any WordPress operator running the affected plugin version.

An attacker identifies a WordPress site running JetEngine 3.8.14.2 or earlier and crafts a URL embedding a JavaScript payload in a parameter that JetEngine reflects without sanitization. The attacker delivers this URL to a logged-in WordPress administrator via a phishing email or compromised referral link. When the administrator loads the page, the injected script executes in their browser, exfiltrates their session cookie to an attacker-controlled endpoint, and the attacker uses the stolen session to authenticate as administrator and take over the site.