CVE-2026-17019
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The JetEngine WordPress plugin before version 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
Risk Assessment
The risk includes session hijacking, data theft, and spreading malware in visitors' browsers.
Recommendation
Update the plugin to version 3.8.13.1 or later and implement validation and sanitization of uploaded SVG files.
Other vulnerabilities in JetEngine
See all- CVE-2026-97238Medium
Cross Site Scripting (XSS) vulnerability in JetEngine up to version 3.8.14.3. A subscriber can inject malicious scripts.
- CVE-2026-97237High
Unauthenticated XSS attack in JetEngine plugin up to version 3.8.14.3. An attacker can inject malicious script without authentication.
- CVE-2026-66581High
Unauthenticated Cross Site Scripting (XSS) in JetEngine versions up to and including 3.8.14.1.
- CVE-2026-65467Medium
The JetEngine plugin version 3.8.11 and earlier is vulnerable to SSRF attacks from a contributor role. A user with contributor privileges can send requests to internal network resources.
- CVE-2026-54189High
Versions of JetEngine up to 3.8.10 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-54188High
Versions of JetEngine up to 3.8.10 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-49074High
There is an unauthenticated Cross Site Scripting (XSS) vulnerability in JetEngine versions <= 3.8.9.1. An attacker can exploit this flaw to inject malicious scripts in the user's context.
- CVE-2026-66613Critical
Unauthenticated remote code execution (RCE) vulnerability in JetEngine plugin versions up to and including 3.8.14. An attacker can execute arbitrary code on the server without logging in.
- CVE-2026-56068Critical
The JetEngine plugin for WordPress versions 3.8.10.2 and earlier contains an SQL injection vulnerability that can be exploited by an unauthenticated attacker. This vulnerability allows unauthorized database queries to be executed.
- CVE-2026-54187Critical
There is an unauthenticated SQL injection vulnerability in JetEngine versions <= 3.8.10.1.
Original NVD description (English source)
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS