# CVE-2026-97237: Crocoblock JetEngine unauthenticated cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-97237-unauthenticated-cross-site-scripting-xss-in-jetengine-3-8-14-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-97237 · Severity: high · CVSS 7.1 · Published 2026-09-30

JetEngine is a WordPress plugin that enables users to create dynamic content without coding. Attackers can inject malicious JavaScript into pages viewed by site administrators and other users, allowing credential theft or account takeover. The attack requires social engineering (trick a user into clicking a malicious link or visiting a crafted page), but no authentication is needed to craft the exploit.

Technologies: [Crocoblock JetEngine](https://junglewise.ai/threats/technologies/jetengine). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-97237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97237 being exploited in the wild.

**How severe is CVE-2026-97237?** High severity, with a CVSS score of 7.1, published 30 September 2026.

**Which products and versions are affected?** Crocoblock JetEngine <= 3.8.14.3.

**Is there a fix for CVE-2026-97237?** A patch was published on 2026-09-24: Fixed in version 3.8.15 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97237 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-97237?** Check whether you run Crocoblock JetEngine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Unauthenticated reflected or stored XSS vulnerability in JetEngine affecting versions up to 3.8.14.3. The vulnerability requires user interaction—a privileged user must click a malicious link or perform an action on a crafted page—to execute injected scripts. Successful exploitation allows attackers to steal session cookies, perform actions as the victim, or redirect to phishing pages. The vulnerability was patched in version 3.8.15.

## Affected products

- Crocoblock JetEngine <= 3.8.14.3

## Timeline

- 2026-09-24: disclosed: Reported by nh4tvd
- 2026-09-24: patched: Fixed in version 3.8.15

## References

- [https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-14-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-14-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve)

## Related threats

- [Crocoblock JetEngine stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125785-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetEngine stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123477-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetEngine SQL injection](https://junglewise.ai/threats/cve-2026-39736-improper-neutralization-of-special-elements-used-in-an-sql)
- [Crocoblock JetEngine broken access control](https://junglewise.ai/threats/cve-2026-39735-missing-authorization-vulnerability-in-crocoblock-jetengine-jet)
- [Crocoblock JetEngine SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-115608-improper-neutralization-of-special-elements-used-in-an-sql)