CVE-2026-49079
CriticalCVSS 9.3Summary
JetSearch versions up to 3.5.17 are vulnerable to unauthenticated SQL injection, potentially allowing unauthorized access to data.
Risk Assessment
An attacker could exploit this vulnerability to manipulate database data, posing a serious threat to the integrity and confidentiality of information within the organization.
Recommendation
It is recommended to upgrade to the latest version of JetSearch to mitigate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in JetSearch
See all- CVE-2026-66577Medium
The JetSearch plugin in versions up to and including 3.6.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
- CVE-2026-61977Medium
The JetSearch WordPress plugin (versions up to 3.6.1.2) contains a vulnerability that allows unauthorized users to access sensitive system information. This flaw enables reading embedded sensitive data, potentially leading to information disclosure.
- CVE-2025-68504Medium
JetSearch up to version 3.5.16 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.
Original NVD description (English source)
Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS