EUVD-2026-37616Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable WordPress plugin, no auth required, but victim must render payload (UI:R); XSS executes in browser context distinct from server (S:C) with limited C/I/A impact bounded by victim privileges.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.
AnalysisAI
Unauthenticated reflected/stored cross-site scripting in the JetEngine WordPress plugin (versions <= 3.8.9.1) allows remote attackers to inject malicious script into pages rendered by the plugin, which then executes in the browser of any visitor who interacts with the crafted content. Successful exploitation enables session hijacking, credential theft, or administrative actions performed against logged-in WordPress users including site administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a target WordPress site running the JetEngine plugin at version 3.8.9.1 or earlier reachable over the network, (2) user interaction - a victim (typically an administrator or logged-in editor) must visit or render the attacker-controlled URL/content containing the XSS payload (per CVSS UI:R), and (3) the attacker delivering the payload through the specific JetEngine input vector identified by Patchstack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L yields 7.1 (High), reflecting network reach, no authentication, but required user interaction and a scope change (typical of XSS executing in another security context - the victim's browser session). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL or submits content containing a malicious script payload targeting a vulnerable JetEngine input handler on a public WordPress site, then sends the link to a site administrator via phishing or embeds it where staff will view it. When the administrator's browser renders the page, the script executes in the WordPress origin and exfiltrates the session cookie or issues authenticated requests (e.g., create new admin user, install a malicious plugin), pivoting from XSS to full site takeover. |
| Remediation | Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data - administrators should upgrade JetEngine to the latest release published by Crocoblock above 3.8.9.1 as soon as it is available and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-9-1-cross-site-scripting-xss-vulnerability for the exact fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress installations and identify those running JetEngine plugin version 3.8.9.1 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Co
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote att
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inj
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to
Share
External POC / Exploit Code
Leaving vuln.today