5.4
Moyenne
CVE-2026-14864 The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its…
Description
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| JetEngine 3.8 | premières → < 3.8.12 | 3.8.12 |
Autres CVE de JetEngine
Les 4 CVE de JetEngine →
CVE-2026-18202
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising…
6.8
Moyenne
CVE-2026-17019
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and…
6.1
Moyenne
CVE-2023-1406
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not…
8.8
Élevée