CVE-2026-12360

Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.10.2

Description The JetEngine plugin for WordPress contains a flaw in the 'listing load more' AJAX handler. The handler accepts a filtered query parameter that is excluded from the HMAC query signature check to allow front-end filter integration. Because meta query row values within filtered query are not sanitized before being merged into SQL construction, unauthenticated attackers can perform time-based or boolean blind SQL injection. This is achieved by appending a malicious meta query value to a Load More AJAX request captured from any public Listing Grid page.

Recommendations Update to a version newer than 3.8.10.1. As a temporary workaround, restrict access to the 'listing load more' AJAX handler or avoid using the filtered query parameter in public Listing Grid pages until the update is applied.