CVE-2026-28082: WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

Affected Software

1 affected component

WordPress JetEngine<=3.8.13.1

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress JetEngine plugin to a version that resolves this vulnerability.
Fixed in 3.8.13.2

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

The severity of CVE-2026-28082 is rated as high with a score of 7.1.

To fix CVE-2026-28082, update the JetEngine plugin to version 3.8.13.2 or later.

CVE-2026-28082 allows unauthenticated users to perform Cross Site Scripting (XSS) attacks.

JetEngine versions 3.8.13.1 and earlier are affected by CVE-2026-28082.

No, authentication is not required to exploit CVE-2026-28082 as it is an unauthenticated XSS vulnerability.