PT-2026-78292

CVE-2026-18202

Published

2026-08-19

Updated

2026-10-22

Description by

CVSS 3.1

6.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JetEngine WordPress plugin versions prior to 3.8.14

Description Insufficient sanitization of uploaded SVG files allows users with file upload capabilities, such as Authors, to upload files containing malicious JavaScript. This leads to Stored Cross-Site Scripting (XSS), where the script executes in the browser of any user who opens the file. In multisite environments, this issue overrides upload-type restrictions configured by the network administrator.

Recommendations Update JetEngine WordPress plugin to version 3.8.14 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Erwan Lr

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers