PT-2026-67054 · WordPress · Jetengine
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
JetEngine versions prior to 3.8.12
Description
Stored Cross-Site Scripting (XSS) occurs because the plugin fails to escape a post meta value before outputting it through a shortcode. This allows users with the Contributor role or higher to execute malicious scripts in the context of users with higher privileges, such as administrators.
Recommendations
Update JetEngine to version 3.8.12 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jetengine