EUVD-2026-90216
GHSA-8744-cxh8-r23v
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Authenticated low-priv attacker stores payload (PR:L) executed only when a victim views the page (UI:R); browser-context execution crosses scope (S:C) with low CIA impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS.
This issue affects JetEngine: from n/a through 3.8.15.3.
AnalysisAI
Stored cross-site scripting (XSS) in the JetEngine WordPress plugin, versions through 3.8.15.3, allows an authenticated user with low-level privileges to persist malicious JavaScript that executes in the browser of any user who subsequently views the affected page. The flaw carries a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a scope change with limited confidentiality and integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at least low-level privileges on a site running JetEngine version n/a through 3.8.15.3 (PR:L), and a second user (typically an administrator or content viewer) must subsequently render the page containing the stored payload (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity, low-real-world-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the source data does not specify a fixed release, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-15-3-cross-site-scripting-xss-vulnerability?_s_id=cve) and the vendor's update channel for a patched JetEngine version and apply it as soon as one is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remo
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated atta
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Co
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8),
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or hig
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote att
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attacke
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inj
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authent
The JetEngine plugin for WordPress contains a SQL injection vulnerability in the listing_load_more AJAX action that allo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today