8.8
High
CVE-2023-1406 The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not…
Description
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| JetEngine 3.1 | earliest → < 3.1.3.1 | 3.1.3.1 |
Other CVEs of JetEngine
The 4 CVEs of JetEngine →
CVE-2026-18202
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising…
6.8
Medium
CVE-2026-17019
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and…
6.1
Medium
CVE-2026-14864
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its…
5.4
Medium