CVE-2026-18202

Name of the Vulnerable Software and Affected Versions JetEngine WordPress plugin versions prior to 3.8.14

Description Insufficient sanitization of uploaded SVG files allows users with file upload capabilities, such as Authors, to upload files containing malicious JavaScript. This leads to Stored Cross-Site Scripting (XSS), where the script executes in the browser of any user who opens the file. In multisite environments, this issue overrides upload-type restrictions configured by the network administrator.

Recommendations Update JetEngine WordPress plugin to version 3.8.14 or later.