CVE-2026-81760: WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS.
This issue affects JetEngine: from n/a through 3.8.14.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetEngine pluginto a version that resolves this vulnerability.Fixed in 3.8.14.3
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is remotely reachable and requires no privileges, but it does require user interaction. An attacker would need to cause a user to interact with crafted input that triggers the reflected XSS condition.
Which JetEngine versions are affected?
JetEngine versions through 3.8.14.2 are affected. The available information does not identify a fixed version.
What impact could successful exploitation have?
Successful exploitation can affect confidentiality, integrity, and availability at low impact levels, with scope changed. The CVSS vector indicates network access, low attack complexity, no required privileges, and required user interaction.