6.1
Moyenne
CVE-2026-17019 The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and…
Description
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| JetEngine 3.8 | premières → < 3.8.13.1 | 3.8.13.1 |
Autres CVE de JetEngine
Les 4 CVE de JetEngine →
CVE-2026-18202
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising…
6.8
Moyenne
CVE-2026-14864
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its…
5.4
Moyenne
CVE-2023-1406
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not…
8.8
Élevée