6.8
Moyenne
CVE-2026-18202 The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising…
Description
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| JetEngine 3.8 | premières → < 3.8.14 | 3.8.14 |
Autres CVE de JetEngine
Les 4 CVE de JetEngine →
CVE-2026-17019
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and…
6.1
Moyenne
CVE-2026-14864
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its…
5.4
Moyenne
CVE-2023-1406
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not…
8.8
Élevée