CVE-2026-107870: WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetEngine pluginto a version that resolves this vulnerability.Fixed in 3.8.16.1
Event History
Frequently Asked Questions
Which JetEngine versions are affected?
JetEngine versions through 3.8.16 are affected. The available data does not identify a fixed version.
What must an attacker do to exploit this issue?
The CVSS vector indicates exploitation is network-accessible, requires low complexity, needs no privileges, and requires user interaction. The issue is a DOM-based XSS vulnerability during web page generation.
What impact could successful exploitation have?
The reported impact includes low confidentiality, integrity, and availability effects, with scope changed. This means exploitation may affect resources beyond the vulnerable component's original security authority.