Stored Cross-Site Scripting Vulnerability in JetEngine WordPress Plugin
CVE-2026-14864
Key Information:
Badges
What is CVE-2026-14864?
The JetEngine plugin for WordPress, prior to version 3.8.12, is susceptible to stored cross-site scripting (XSS) attacks. In this vulnerability, the plugin fails to properly escape post meta values before rendering them through shortcodes. This oversight allows users with Contributor roles and above to inject malicious scripts, which are then executed in the context of users with higher privileges, such as administrators. As a result, this poses a significant risk to the integrity of the WordPress installations utilizing this plugin.
Affected Version(s)
JetEngine 0 < 3.8.12
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.