CVE-2026-18202: JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JetEngine (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.8.14
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress upload_files capability can exploit it. This can include Authors, depending on the site's role and capability configuration.
What must an attacker do to trigger the issue?
The attacker must upload an SVG file containing malicious JavaScript. The script executes when another user opens the uploaded SVG in their browser.
Are WordPress multisite installations affected by network upload restrictions?
Yes. On multisite, affected JetEngine versions override an upload-type restriction configured by the network administrator, allowing SVG uploads despite that restriction.
What version resolves the issue?
Update JetEngine to version 3.8.14 or later. Versions before 3.8.14 are affected.