7.5
High
CVE-2026-12360 The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1
Description
The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| JetEngine 3.8 | earliest → 3.8.10.1 | No fix stated |
Other CVEs of JetEngine
The 25 CVEs of JetEngine →
CVE-2026-39736
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock…
8.5
High
CVE-2026-39735
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access…
6.5
Medium
CVE-2026-115608
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock…
8.5
High
CVE-2026-107870
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…
7.1
High