PT-2026-69360

CVE-2026-17019

·

Published

2026-08-05

·

Updated

2026-08-10

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions JetEngine WordPress plugin versions prior to 3.8.13.1
Description Stored Cross-Site Scripting occurs because the software fails to sanitize uploaded SVG files before storing and serving them. Additionally, the system does not adequately restrict upload permissions, allowing unauthenticated attackers to upload files containing malicious JavaScript. This script executes in the browser of any user who opens the uploaded file.
Recommendations Update JetEngine WordPress plugin to version 3.8.13.1 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-17019
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com