WordPress Plugin Vulnerabilities

JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode

Description

The plugin does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.

Proof of Concept

Affects Plugins

Plugin icon
jet-engine
Fixed in 3.8.12

References

CVE
CVE-2026-14864

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
axbqd
Submitter
axbqd
Verified
Yes
WPVDB ID
7222601e-4f2b-4dfb-88aa-692a556f3e86

Timeline

Publicly Published
2026-07-20 (about 13 days ago)
Added
2026-07-20 (about 12 days ago)
Last Updated
2026-07-20 (about 12 days ago)

Other

Published
Title
Published
2025-01-03
Title
Free Google Maps <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2025-06-26
Title
Osom Blocks < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter
Published
2026-07-08
Title
Download Manager < 3.3.62 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
Published
2021-12-23
Title
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS
Published
2019-07-09
Title
Gallery Photoblocks < 1.1.43 - Authenticated Reflected XSS