CVE-2025-26870: WordPress JetEngine plugin <= 3.6.4.1 - Cross Site Scripting (XSS) vulnerability

Q: What is the severity of CVE-2025-26870?

CVE-2025-26870 is classified as a high-severity vulnerability due to its potential for exploitation via DOM-Based XSS.

Q: How do I fix CVE-2025-26870?

To fix CVE-2025-26870, update NotFound JetEngine to version 3.6.4.2 or later.

Q: What type of vulnerability is CVE-2025-26870?

CVE-2025-26870 is a Cross-site Scripting (XSS) vulnerability impacting web page generation.

Q: Which versions of JetEngine are affected by CVE-2025-26870?

CVE-2025-26870 affects NotFound JetEngine versions up to and including 3.6.4.1.

Q: Is CVE-2025-26870 specific to a certain platform?

Yes, CVE-2025-26870 specifically affects NotFound JetEngine and WordPress implementations of JetEngine.

Published Apr 15, 2025

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through <= 3.6.4.1.

Other sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound JetEngine allows DOM-Based XSS. This issue affects JetEngine: from n/a through 3.6.4.1.

— NVD

Affected Software

1 affected component

Crocoblock JetEngine<=3.6.4.1

Remediation

Information

Update the WordPress JetEngine plugin to the latest available version (at least 3.6.5).

Event History

Apr 15, 2025

CVE Published

via MITRE·09:53 PM

Data Sourced

via MITRE·09:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-26870?

CVE-2025-26870 is classified as a high-severity vulnerability due to its potential for exploitation via DOM-Based XSS.

How do I fix CVE-2025-26870?

To fix CVE-2025-26870, update NotFound JetEngine to version 3.6.4.2 or later.

What type of vulnerability is CVE-2025-26870?