JetEngine vulnerabilities

Unauthenticated Cross Site Scripting (XSS) in JetEngine versions up to and including 3.8.14.1.

The JetEngine plugin version 3.8.11 and earlier is vulnerable to SSRF attacks from a contributor role. A user with contributor privileges can send requests to internal network resources.

Versions of JetEngine up to 3.8.10 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Versions of JetEngine up to 3.8.10 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

There is an unauthenticated Cross Site Scripting (XSS) vulnerability in JetEngine versions <= 3.8.9.1. An attacker can exploit this flaw to inject malicious scripts in the user's context.

Unauthenticated remote code execution (RCE) vulnerability in JetEngine plugin versions up to and including 3.8.14. An attacker can execute arbitrary code on the server without logging in.

The JetEngine plugin for WordPress versions 3.8.10.2 and earlier contains an SQL injection vulnerability that can be exploited by an unauthenticated attacker. This vulnerability allows unauthorized database queries to be executed.

There is an unauthenticated SQL injection vulnerability in JetEngine versions <= 3.8.10.1.

There is an unauthenticated PHP object injection vulnerability in JetEngine versions up to 3.8.10.

JetEngine versions below 3.8.9.1 are vulnerable to unauthenticated SQL injection.

There is an unauthenticated SQL injection vulnerability in JetEngine versions up to 3.8.9.1.

JetEngine versions up to 3.8.9.1 are vulnerable to PHP Object Injection, which may lead to unauthorized access to data.

The JetEngine plugin for WordPress by Crocoblock is vulnerable to SQL Injection. The issue affects all versions up to and including 3.8.8.1. Improper neutralization of special elements used in SQL commands allows an attacker to execute arbitrary SQL queries.

Reflected Cross-Site Scripting (XSS) vulnerability in the JetEngine plugin by Crocoblock. Improper neutralization of input during web page generation allows reflection of a malicious script in the server response.

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitizing file contents, allowing users with upload capability, such as Authors, to upload files containing malicious JavaScript that executes in the browser of any user who opens it (Stored XSS). On multisite, this also overrides an upload-type restriction set by the network administrator.

The JetEngine WordPress plugin before version 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).

Unauthenticated Cross Site Scripting (XSS) vulnerability in JetEngine versions up to 3.8.13.1. An attacker can inject malicious script without authentication.