CVE-2026-17019: JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JetEngine WordPress pluginto a version that resolves this vulnerability.Fixed in 3.8.13.1 - Configuration
Ensure only authenticated and authorized users can upload files (specifically SVG files) so unauthenticated attackers cannot upload malicious SVG content.
JetEngine WordPress plugin unauthenticated SVG upload permission (who can upload SVG files) = restricted to authenticated/authorized users only
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17019?
CVE-2026-17019 has a risk score of 54, indicating a moderate severity level.
How do I fix CVE-2026-17019?
To fix CVE-2026-17019, update the JetEngine plugin to version 3.8.13.1 or later.
What type of vulnerability is CVE-2026-17019?
CVE-2026-17019 is an unauthenticated stored cross-site scripting (XSS) vulnerability.
What is the impact of CVE-2026-17019?
CVE-2026-17019 allows unauthenticated attackers to upload malicious SVG files that can execute JavaScript in the user's browser.
Who is affected by CVE-2026-17019?
Any WordPress site using JetEngine versions prior to 3.8.13.1 is vulnerable to CVE-2026-17019.