Stored Cross-Site Scripting Vulnerability in JetEngine WordPress Plugin
CVE-2026-18202
Key Information:
Badges
What is CVE-2026-18202?
The JetEngine WordPress plugin prior to version 3.8.14 permits the inclusion of SVG files in the allowed upload types without proper sanitization of the file contents. This vulnerability enables users, such as Authors with file upload capabilities, to upload files containing malicious JavaScript. When executed, this script runs in the browsers of users who open the uploaded file, potentially leading to unauthorized actions or data exposure. In multisite environments, this oversight bypasses any upload-type restrictions established by the network administrator.
Affected Version(s)
JetEngine 0 < 3.8.14
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.