7.5
Élevée
CVE-2026-12360 The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1
Description
The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| JetEngine 3.8 | premières → 3.8.10.1 | Pas de correctif indiqué |
Autres CVE de JetEngine
Les 25 CVE de JetEngine →
CVE-2026-39736
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock…
8.5
Élevée
CVE-2026-39735
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access…
6.5
Moyenne
CVE-2026-115608
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock…
8.5
Élevée
CVE-2026-107870
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…
7.1
Élevée