Jetimpex Inc
Monthly
Reflected or stored cross-site scripting in the JetEngine WordPress plugin (versions 3.8.10 and earlier) allows remote unauthenticated attackers to inject arbitrary script that executes in a victim's browser after the user is lured to a crafted link or page. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 7.1 with scope change, reflecting impact on the WordPress session context beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject malicious scripts that execute in the browser of any user who interacts with a crafted link or page. The CVSS 7.1 score reflects the scope change inherent to XSS (attacker-supplied JavaScript runs in the victim's site origin), and no public exploit has been identified at time of analysis. Successful exploitation can lead to session hijacking, credential theft, or administrative account takeover on affected WordPress sites.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. The CVSS 3.1 score of 9.3 (Critical) reflects a scope change with high confidentiality and low availability impact, indicating attacker-controlled queries can reach data beyond the plugin's own context. No public exploit identified at time of analysis, but the lack of authentication requirements makes this a high-priority patch target for any site running the affected versions.
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject arbitrary PHP objects, potentially leading to full site compromise via gadget-chain abuse. The CVSS 9.8 score reflects network-reachable, no-authentication, no-interaction exploitation against a widely deployed commercial WordPress plugin. No public exploit identified at time of analysis, but the unsafe-deserialization class (CWE-502) historically yields fast weaponization once a usable POP chain is published.
Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inject malicious SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 3.1 score of 9.3 with a changed scope, enabling data disclosure across the WordPress installation and partial impact on availability. No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with JetEngine's wide deployment across Crocoblock-powered WordPress sites makes this a high-priority issue.
Unauthenticated SQL injection in the JetSearch WordPress plugin (versions <= 3.5.17) allows remote attackers to inject arbitrary SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 9.3 (Critical) score with a scope change, meaning impact extends beyond the plugin to the underlying WordPress database. No public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication requirement make this a high-priority patching target for any WordPress site running the plugin.
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote attackers without credentials to inject arbitrary SQL through plugin-handled inputs. With a CVSS 3.1 score of 9.3 (scope-changed) and no authentication or user interaction required, the flaw is well-suited for opportunistic, mass exploitation of WordPress sites that use this popular Crocoblock plugin. No public exploit identified at time of analysis, but Patchstack has catalogued the issue, indicating vendor-side confirmation.
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Contributor role to inject crafted serialized objects that are deserialized by the plugin, potentially leading to code execution or other gadget-chain abuse on the host site. The flaw, reported by Patchstack and tracked under CWE-502, requires only the low-privileged Contributor role rather than admin access, which significantly broadens the attacker pool on multi-author WordPress installations. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated reflected/stored cross-site scripting in the JetEngine WordPress plugin (versions <= 3.8.9.1) allows remote attackers to inject malicious script into pages rendered by the plugin, which then executes in the browser of any visitor who interacts with the crafted content. Successful exploitation enables session hijacking, credential theft, or administrative actions performed against logged-in WordPress users including site administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the JetSmartFilters WordPress plugin (versions ≤ 3.8.1) allows remote attackers to inject arbitrary SQL queries against the underlying WordPress database without any authentication or user interaction. The CVSS 9.3 score reflects a scope-changing flaw with high confidentiality impact and low availability impact, and no public exploit has been identified at time of analysis. The vulnerability was disclosed via Patchstack and affects a popular Crocoblock/JetImpex filtering plugin widely deployed on WordPress sites.
Reflected or stored cross-site scripting in the JetEngine WordPress plugin (versions 3.8.10 and earlier) allows remote unauthenticated attackers to inject arbitrary script that executes in a victim's browser after the user is lured to a crafted link or page. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 7.1 with scope change, reflecting impact on the WordPress session context beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject malicious scripts that execute in the browser of any user who interacts with a crafted link or page. The CVSS 7.1 score reflects the scope change inherent to XSS (attacker-supplied JavaScript runs in the victim's site origin), and no public exploit has been identified at time of analysis. Successful exploitation can lead to session hijacking, credential theft, or administrative account takeover on affected WordPress sites.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions 3.8.10.1 and earlier allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. The CVSS 3.1 score of 9.3 (Critical) reflects a scope change with high confidentiality and low availability impact, indicating attacker-controlled queries can reach data beyond the plugin's own context. No public exploit identified at time of analysis, but the lack of authentication requirements makes this a high-priority patch target for any site running the affected versions.
Unauthenticated PHP Object Injection in Crocoblock JetEngine WordPress plugin versions 3.8.10 and earlier allows remote attackers to inject arbitrary PHP objects, potentially leading to full site compromise via gadget-chain abuse. The CVSS 9.8 score reflects network-reachable, no-authentication, no-interaction exploitation against a widely deployed commercial WordPress plugin. No public exploit identified at time of analysis, but the unsafe-deserialization class (CWE-502) historically yields fast weaponization once a usable POP chain is published.
Sensitive data exposure in the JetBlog WordPress plugin (versions 2.4.8 and earlier) allows remote unauthenticated attackers to retrieve confidential information from affected sites over the network with no user interaction. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.5 (high confidentiality impact only). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.
Unauthenticated SQL injection in the JetEngine WordPress plugin versions prior to 3.8.9.1 allows remote attackers to inject malicious SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 3.1 score of 9.3 with a changed scope, enabling data disclosure across the WordPress installation and partial impact on availability. No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with JetEngine's wide deployment across Crocoblock-powered WordPress sites makes this a high-priority issue.
Unauthenticated SQL injection in the JetSearch WordPress plugin (versions <= 3.5.17) allows remote attackers to inject arbitrary SQL into backend database queries without any authentication or user interaction. The flaw carries a CVSS 9.3 (Critical) score with a scope change, meaning impact extends beyond the plugin to the underlying WordPress database. No public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication requirement make this a high-priority patching target for any WordPress site running the plugin.
Unauthenticated SQL injection in the JetEngine WordPress plugin (versions up to and including 3.8.9.1) allows remote attackers without credentials to inject arbitrary SQL through plugin-handled inputs. With a CVSS 3.1 score of 9.3 (scope-changed) and no authentication or user interaction required, the flaw is well-suited for opportunistic, mass exploitation of WordPress sites that use this popular Crocoblock plugin. No public exploit identified at time of analysis, but Patchstack has catalogued the issue, indicating vendor-side confirmation.
PHP Object Injection in the JetEngine WordPress plugin (versions through 3.8.9.1) allows authenticated users with the Contributor role to inject crafted serialized objects that are deserialized by the plugin, potentially leading to code execution or other gadget-chain abuse on the host site. The flaw, reported by Patchstack and tracked under CWE-502, requires only the low-privileged Contributor role rather than admin access, which significantly broadens the attacker pool on multi-author WordPress installations. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated reflected/stored cross-site scripting in the JetEngine WordPress plugin (versions <= 3.8.9.1) allows remote attackers to inject malicious script into pages rendered by the plugin, which then executes in the browser of any visitor who interacts with the crafted content. Successful exploitation enables session hijacking, credential theft, or administrative actions performed against logged-in WordPress users including site administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the JetSmartFilters WordPress plugin (versions ≤ 3.8.1) allows remote attackers to inject arbitrary SQL queries against the underlying WordPress database without any authentication or user interaction. The CVSS 9.3 score reflects a scope-changing flaw with high confidentiality impact and low availability impact, and no public exploit has been identified at time of analysis. The vulnerability was disclosed via Patchstack and affects a popular Crocoblock/JetImpex filtering plugin widely deployed on WordPress sites.