6.8
Medium
CVE-2026-18202 The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising…
Description
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| JetEngine 3.8 | earliest → < 3.8.14 | 3.8.14 |
Other CVEs of JetEngine
The 4 CVEs of JetEngine →
CVE-2026-17019
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and…
6.1
Medium
CVE-2026-14864
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its…
5.4
Medium
CVE-2023-1406
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not…
8.8
High