Executive brief
JetEngine, a popular WordPress plugin used for creating dynamic content and custom website structures, contains a security flaw that allows attackers to inject malicious scripts. If a site administrator or visitor clicks on a specially crafted link, an attacker could execute code in their browser, potentially leading to unauthorized actions, data theft, or website defacement. This vulnerability can be exploited by anyone on the internet without needing an account on the affected site.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the JetEngine plugin for WordPress (versions <= 3.8.10) due to improper neutralization of user-supplied input during web page generation (CWE-79). The flaw is unauthenticated, meaning an attacker does not need a login to initiate the attack, though successful exploitation requires user interaction (typically a victim clicking a malicious link). By leveraging this vulnerability, an attacker can execute arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized administrative actions. The issue is resolved in version 3.8.10.1.
Affected products
- Jetimpex Inc. JetEngine <= 3.8.10
Timeline
- 2026-06-08: other: Reported by VanTastic
- 2026-06-16: advisory: Patchstack advisory published
- 2026-06-17: disclosed: NVD publication date