Plugin icon

JetEngine

jet-engine

Vulnerabilities:

43

Last Updated:

November 7, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2026-10-29
Title
JetEngine < 3.9.0.2 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 3.9.0.2
CVSS
4.9 (medium)
Published
2026-10-29
Title
JetEngine < 3.9.0.2 - Missing Authorization
Fixed in
Fixed in 3.9.0.2
CVSS
4.3 (medium)
Published
2026-10-26
Title
JetEngine < 3.9.0.1 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 3.9.0.1
CVSS
4.9 (medium)
Published
2026-10-12
Title
JetEngine < 3.8.16.1 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.16.1
CVSS
7.2 (high)
Published
2026-09-30
Title
JetEngine < 3.8.15.4 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.15.4
CVSS
7.2 (high)
Published
2026-09-24
Title
JetEngine < 3.8.15 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.15
CVSS
7.2 (high)
Published
2026-09-24
Title
JetEngine < 3.8.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.15
CVSS
6.4 (medium)
Published
2026-08-27
Title
JetEngine < 3.8.14.3 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.14.3
CVSS
7.2 (high)
Published
2026-08-19
Title
JetEngine < 3.8.14.2 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.14.2
CVSS
7.2 (high)
Published
2026-08-19
Title
JetEngine < 3.8.14.1 - Unauthenticated Remote Code Execution
Fixed in
Fixed in 3.8.14.1
CVSS
9.8 (critical)
Published
2026-08-17
Title
JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload
Fixed in
Fixed in 3.8.14
CVSS
6.8 (medium)
Published
2026-08-05
Title
JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)
Fixed in
Fixed in 3.8.13.1
CVSS
8.8 (high)
Published
2026-08-03
Title
JetEngine < 3.8.13.2 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.13.2
CVSS
7.2 (high)
Published
2026-07-22
Title
JetEngine < 3.8.12 - Authenticated (Contributor+) Sever-Side Request Forgery
Fixed in
Fixed in 3.8.12
CVSS
5.5 (medium)
Published
2026-07-20
Title
JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode
Fixed in
Fixed in 3.8.12
CVSS
6.8 (medium)
Published
2026-06-25
Title
JetEngine < 3.8.11 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.8.11
CVSS
7.5 (high)
Published
2026-06-16
Title
JetEngine < 3.8.10.1 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.10.1
CVSS
7.2 (high)
Published
2026-06-16
Title
JetEngine < 3.8.10.1 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.10.1
CVSS
7.2 (high)
Published
2026-06-16
Title
JetEngine < 3.8.10.2 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
Fixed in
Fixed in 3.8.10.2
CVSS
7.5 (high)
Published
2026-06-15
Title
JetEngine < 3.8.10.2 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.8.10.2
CVSS
7.5 (high)
Published
2026-06-12
Title
JetEngine < 3.8.10.1 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 3.8.10.1
CVSS
8.1 (high)
Published
2026-06-08
Title
JetEngine < 3.8.10 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.8.10
CVSS
7.2 (high)
Published
2026-06-08
Title
JetEngine < 3.8.9.1 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.8.9.1
CVSS
7.5 (high)
Published
2026-06-08
Title
JetEngine < 3.8.10 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.8.10
CVSS
7.5 (high)
Published
2026-06-08
Title
JetEngine < 3.8.10 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 3.8.10
CVSS
6.6 (medium)
Published
2026-04-30
Title
JetEngine < 3.8.8.2 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.8.8.2
CVSS
7.5 (high)
Published
2026-04-13
Title
JetEngine < 3.8.6.2 - Unauthenticated SQL Injection via '_cct_search' Parameter
Fixed in
Fixed in 3.8.6.2
CVSS
7.5 (high)
Published
2026-03-23
Title
JetEngine < 3.8.6.2 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter
Fixed in
Fixed in 3.8.6.2
CVSS
7.5 (high)
Published
2026-02-26
Title
JetEngine < 3.8.1.2 - Authenticated (Contributor+) Remote Code Execution
Fixed in
Fixed in 3.8.1.2
CVSS
7.2 (high)
Published
2026-02-14
Title
JetEngine < 3.8.4.1 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 3.8.4.1
CVSS
6.6 (medium)
Published
2026-02-11
Title
JetEngine < 3.8.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.8.1
CVSS
6.1 (medium)
Published
2026-01-05
Title
JetEngine < 3.7.8 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.7.8
CVSS
7.2 (high)
Published
2025-12-30
Title
JetEngine < 3.8.1.2 - Missing Authorization
Fixed in
Fixed in 3.8.1.2
CVSS
4.3 (medium)
Published
2025-09-18
Title
JetEngine < 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.7.4
CVSS
6.4 (medium)
Published
2025-07-30
Title
JetEngine < 3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.7.2
CVSS
6.4 (medium)
Published
2025-07-16
Title
JetEngine < 3.7.1.1 - Authenticated (Subscriber+) Information Exposure
Fixed in
Fixed in 3.7.1.1
CVSS
4.3 (medium)
Published
2025-07-13
Title
JetEngine < 3.7.1.1 - Contributor+ RCE via Server-Side Template Injection
Fixed in
Fixed in 3.7.1.1
CVSS
6.6 (medium)
Published
2025-06-27
Title
JetEngine < 3.7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.7.1.1
CVSS
6.4 (medium)
Published
2025-04-11
Title
JetEngine < 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.6.5
CVSS
6.4 (medium)
Published
2025-01-17
Title
Jet Engine < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter
Fixed in
Fixed in 3.6.3
CVSS
6.4 (medium)
Published
2023-11-28
Title
JetEngine < 3.2.5 - Missing Authorization
Fixed in
Fixed in 3.2.5
CVSS
7.1 (high)
Published
2023-11-28
Title
JetEngine < 3.2.5 - Authenticated (Contributor+) Privilege Escalation
Fixed in
Fixed in 3.2.5
CVSS
8.8 (high)
Published
2023-03-20
Title
JetEngine < 3.1.3.1 - Author+ Remote Code Execution
Fixed in
Fixed in 3.1.3.1
CVSS
7.2 (high)