Unauthenticated Cross Site Scripting in JetEngine by Crocoblock
CVE-2026-54189

7.1HIGH

Key Information:

Vendor

WordPress
Status
Jetengine
Vendor
CVE Published:
17 June 2026

What is CVE-2026-54189?

The JetEngine plugin by Crocoblock is susceptible to an unauthenticated Cross Site Scripting (XSS) vulnerability in versions up to 3.8.10. This vulnerability allows attackers to inject malicious scripts into web pages that users may visit, compromising the security of the site and its users. It is imperative for WordPress site administrators using JetEngine to update to the latest version to mitigate the risk posed by this security flaw.

Affected Version(s)

JetEngine <= 3.8.10

References

https://patchstack.com/database/wordpress/plugin/jet-engi...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

VanTastic | Patchstack Bug Bounty Program
.