Jetengine
Monthly
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Reflected cross-site scripting in Crocoblock's JetEngine WordPress plugin (all versions through 3.8.14.2) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to follow a specially crafted URL. The scope-change component of the CVSS vector indicates that successful exploitation breaks out of the plugin's immediate context to affect the broader browser session, enabling session token theft or administrative action impersonation. No public exploit code or active exploitation has been confirmed at time of analysis; the flaw was disclosed by Patchstack.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Reflected or stored cross-site scripting in the JetEngine WordPress plugin (versions 3.8.10 and earlier) allows remote unauthenticated attackers to inject arbitrary script that executes in a victim's browser after the user is lured to a crafted link or page. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 7.1 with scope change, reflecting impact on the WordPress session context beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject malicious scripts that execute in the browser of any user who interacts with a crafted link or page. The CVSS 7.1 score reflects the scope change inherent to XSS (attacker-supplied JavaScript runs in the victim's site origin), and no public exploit has been identified at time of analysis. Successful exploitation can lead to session hijacking, credential theft, or administrative account takeover on affected WordPress sites.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. The CVSS 3.1 score of 9.3 (Critical) reflects a scope change with high confidentiality and low availability impact, indicating attacker-controlled queries can reach data beyond the plugin's own context. No public exploit identified at time of analysis, but the lack of authentication requirements makes this a high-priority patch target for any site running the affected versions.
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject arbitrary PHP objects, potentially leading to full site compromise via gadget-chain abuse. The CVSS 9.8 score reflects network-reachable, no-authentication, no-interaction exploitation against a widely deployed commercial WordPress plugin. No public exploit identified at time of analysis, but the unsafe-deserialization class (CWE-502) historically yields fast weaponization once a usable POP chain is published.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inject malicious SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 3.1 score of 9.3 with a changed scope, enabling data disclosure across the WordPress installation and partial impact on availability. No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with JetEngine's wide deployment across Crocoblock-powered WordPress sites makes this a high-priority issue.
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote attackers without credentials to inject arbitrary SQL through plugin-handled inputs. With a CVSS 3.1 score of 9.3 (scope-changed) and no authentication or user interaction required, the flaw is well-suited for opportunistic, mass exploitation of WordPress sites that use this popular Crocoblock plugin. No public exploit identified at time of analysis, but Patchstack has catalogued the issue, indicating vendor-side confirmation.
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Contributor role to inject crafted serialized objects that are deserialized by the plugin, potentially leading to code execution or other gadget-chain abuse on the host site. The flaw, reported by Patchstack and tracked under CWE-502, requires only the low-privileged Contributor role rather than admin access, which significantly broadens the attacker pool on multi-author WordPress installations. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated reflected/stored cross-site scripting in the JetEngine WordPress plugin (versions <= 3.8.9.1) allows remote attackers to inject malicious script into pages rendered by the plugin, which then executes in the browser of any visitor who interacts with the crafted content. Successful exploitation enables session hijacking, credential theft, or administrative actions performed against logged-in WordPress users including site administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions up to 3.8.10.1 allows remote attackers to extract database contents via the listing_load_more AJAX handler. The filtered_query parameter is deliberately excluded from the HMAC signature check to enable front-end filter integration, but meta_query row values are merged into SQL without sanitization, enabling time-based or boolean blind injection. No public exploit identified at time of analysis, though the bug was reported by Wordfence and source code locations are publicly referenced.
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attackers to inject crafted SQL into backend queries, leading to high-impact confidentiality disclosure and limited availability impact with a scope change to other components. The flaw carries a CVSS 9.3 rating and was disclosed by Patchstack, but there is no public exploit identified at time of analysis and EPSS is very low at 0.03%.
SQL injection in JetEngine WordPress plugin (≤3.8.6.1) via Custom Content Type REST API allows unauthenticated remote attackers to extract sensitive database information. The vulnerability stems from unsanitized search parameters in REST endpoints, bypassing WordPress's built-in SQL protections. Attack complexity is low (CVSS AC:L) with no user interaction required. EPSS and KEV data not provided; exploitation requires Custom Content Types module enabled with public REST endpoints configured.
The JetEngine plugin for WordPress contains a SQL injection vulnerability in the listing_load_more AJAX action that allows unauthenticated attackers to extract sensitive database information. All versions up to and including 3.8.6.1 are affected. The vulnerability exists on sites using JetEngine Listing Grid with Load More functionality enabled and SQL Query Builder queries, with a CVSS score of 7.5 indicating high severity for confidentiality impact.
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authenticated attackers to inject malicious objects and achieve arbitrary code execution. An attacker with user-level access can exploit this vulnerability without user interaction to fully compromise the affected system. No patch is currently available for this vulnerability.
Stored cross-site scripting (XSS) in the JetEngine WordPress plugin, versions through 3.8.15.3, allows an authenticated user with low-level privileges to persist malicious JavaScript that executes in the browser of any user who subsequently views the affected page. The flaw carries a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a scope change with limited confidentiality and integrity impact. Exploitation requires an existing authenticated account on the target WordPress site plus victim interaction, and no public exploit identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
Stored/DOM cross-site scripting in the JetEngine WordPress plugin (Crocoblock / Jetimpex) affects all versions up to and including 3.8.14.3, allowing an authenticated Subscriber-level user to inject markup that executes in the browser of a higher-privileged victim who views or interacts with the affected content. Rated CVSS 5.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L), exploitation requires valid low-privilege credentials plus victim interaction, and the high attack complexity means additional non-trivial conditions must align for the payload to fire, limiting reliable exploitation. No public exploit code has been identified at the time of analysis, and the issue has not been confirmed as actively exploited.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains targeted rather than widespread at this time.
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or higher to inject persistent malicious scripts via unescaped post meta values rendered by plugin shortcodes, with execution occurring in the browser context of higher-privileged users including administrators. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting limited observed mass exploitation at time of analysis. The scope-change characteristic (S:C in CVSS) elevates the real-world impact: successful exploitation can lead to admin session hijacking or unauthorized privileged actions despite the medium base score.
Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Reflected cross-site scripting in Crocoblock's JetEngine WordPress plugin (all versions through 3.8.14.2) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to follow a specially crafted URL. The scope-change component of the CVSS vector indicates that successful exploitation breaks out of the plugin's immediate context to affect the broader browser session, enabling session token theft or administrative action impersonation. No public exploit code or active exploitation has been confirmed at time of analysis; the flaw was disclosed by Patchstack.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Reflected or stored cross-site scripting in the JetEngine WordPress plugin (versions 3.8.10 and earlier) allows remote unauthenticated attackers to inject arbitrary script that executes in a victim's browser after the user is lured to a crafted link or page. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 7.1 with scope change, reflecting impact on the WordPress session context beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject malicious scripts that execute in the browser of any user who interacts with a crafted link or page. The CVSS 7.1 score reflects the scope change inherent to XSS (attacker-supplied JavaScript runs in the victim's site origin), and no public exploit has been identified at time of analysis. Successful exploitation can lead to session hijacking, credential theft, or administrative account takeover on affected WordPress sites.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. The CVSS 3.1 score of 9.3 (Critical) reflects a scope change with high confidentiality and low availability impact, indicating attacker-controlled queries can reach data beyond the plugin's own context. No public exploit identified at time of analysis, but the lack of authentication requirements makes this a high-priority patch target for any site running the affected versions.
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject arbitrary PHP objects, potentially leading to full site compromise via gadget-chain abuse. The CVSS 9.8 score reflects network-reachable, no-authentication, no-interaction exploitation against a widely deployed commercial WordPress plugin. No public exploit identified at time of analysis, but the unsafe-deserialization class (CWE-502) historically yields fast weaponization once a usable POP chain is published.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inject malicious SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 3.1 score of 9.3 with a changed scope, enabling data disclosure across the WordPress installation and partial impact on availability. No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with JetEngine's wide deployment across Crocoblock-powered WordPress sites makes this a high-priority issue.
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote attackers without credentials to inject arbitrary SQL through plugin-handled inputs. With a CVSS 3.1 score of 9.3 (scope-changed) and no authentication or user interaction required, the flaw is well-suited for opportunistic, mass exploitation of WordPress sites that use this popular Crocoblock plugin. No public exploit identified at time of analysis, but Patchstack has catalogued the issue, indicating vendor-side confirmation.
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Contributor role to inject crafted serialized objects that are deserialized by the plugin, potentially leading to code execution or other gadget-chain abuse on the host site. The flaw, reported by Patchstack and tracked under CWE-502, requires only the low-privileged Contributor role rather than admin access, which significantly broadens the attacker pool on multi-author WordPress installations. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated reflected/stored cross-site scripting in the JetEngine WordPress plugin (versions <= 3.8.9.1) allows remote attackers to inject malicious script into pages rendered by the plugin, which then executes in the browser of any visitor who interacts with the crafted content. Successful exploitation enables session hijacking, credential theft, or administrative actions performed against logged-in WordPress users including site administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions up to 3.8.10.1 allows remote attackers to extract database contents via the listing_load_more AJAX handler. The filtered_query parameter is deliberately excluded from the HMAC signature check to enable front-end filter integration, but meta_query row values are merged into SQL without sanitization, enabling time-based or boolean blind injection. No public exploit identified at time of analysis, though the bug was reported by Wordfence and source code locations are publicly referenced.
SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attackers to inject crafted SQL into backend queries, leading to high-impact confidentiality disclosure and limited availability impact with a scope change to other components. The flaw carries a CVSS 9.3 rating and was disclosed by Patchstack, but there is no public exploit identified at time of analysis and EPSS is very low at 0.03%.
SQL injection in JetEngine WordPress plugin (≤3.8.6.1) via Custom Content Type REST API allows unauthenticated remote attackers to extract sensitive database information. The vulnerability stems from unsanitized search parameters in REST endpoints, bypassing WordPress's built-in SQL protections. Attack complexity is low (CVSS AC:L) with no user interaction required. EPSS and KEV data not provided; exploitation requires Custom Content Types module enabled with public REST endpoints configured.
The JetEngine plugin for WordPress contains a SQL injection vulnerability in the listing_load_more AJAX action that allows unauthenticated attackers to extract sensitive database information. All versions up to and including 3.8.6.1 are affected. The vulnerability exists on sites using JetEngine Listing Grid with Load More functionality enabled and SQL Query Builder queries, with a CVSS score of 7.5 indicating high severity for confidentiality impact.
Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authenticated attackers to inject malicious objects and achieve arbitrary code execution. An attacker with user-level access can exploit this vulnerability without user interaction to fully compromise the affected system. No patch is currently available for this vulnerability.
Stored cross-site scripting (XSS) in the JetEngine WordPress plugin, versions through 3.8.15.3, allows an authenticated user with low-level privileges to persist malicious JavaScript that executes in the browser of any user who subsequently views the affected page. The flaw carries a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a scope change with limited confidentiality and integrity impact. Exploitation requires an existing authenticated account on the target WordPress site plus victim interaction, and no public exploit identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
Stored/DOM cross-site scripting in the JetEngine WordPress plugin (Crocoblock / Jetimpex) affects all versions up to and including 3.8.14.3, allowing an authenticated Subscriber-level user to inject markup that executes in the browser of a higher-privileged victim who views or interacts with the affected content. Rated CVSS 5.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L), exploitation requires valid low-privilege credentials plus victim interaction, and the high attack complexity means additional non-trivial conditions must align for the payload to fire, limiting reliable exploitation. No public exploit code has been identified at the time of analysis, and the issue has not been confirmed as actively exploited.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains targeted rather than widespread at this time.
Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or higher to inject persistent malicious scripts via unescaped post meta values rendered by plugin shortcodes, with execution occurring in the browser context of higher-privileged users including administrators. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting limited observed mass exploitation at time of analysis. The scope-change characteristic (S:C in CVSS) elevates the real-world impact: successful exploitation can lead to admin session hijacking or unauthorized privileged actions despite the medium base score.
Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.