Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · jet-engine
JetEngine
41 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 26, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115608 · affects up to 3.9.0 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.
Oct 14, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107870 · affects up to 3.8.16 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.
Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97265 · affects up to 3.8.15.3 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.CVE-2026-97238 · affects up to 3.8.14.3 · reported by PatchstackMedium 5.5
Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97237 · affects up to 3.8.14.3 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.
Aug 28, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-81760 · affects up to 3.8.14.2 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.CVE-2026-66581 · affects up to 3.8.14.1 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
Aug 19, 2026Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.CVE-2026-66613 · affects up to 3.8.14 · reported by PatchstackCritical 9.8
Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.
Aug 19, 2026JetEngine: Adds SVG to the site-wide list of allowed upload types without sanitising the file contentsCVE-2026-18202 · fixed in 3.8.14 · reported by WPScanMedium 6.8
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.
Aug 10, 2026JetEngine: Does not sanitise uploaded SVG files before storing and serving themCVE-2026-17019 · fixed in 3.8.13.1 · reported by WPScanMedium 6.1
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.CVE-2026-28082 · affects up to 3.8.13.1 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.
Aug 2, 2026JetEngine: Does not escape a post meta value before outputting it through one of its shortcodesCVE-2026-14864 · fixed in 3.8.12 · reported by WPScanMedium 5.4
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.
Jul 23, 2026Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.CVE-2026-65467 · affects up to 3.8.11 · reported by PatchstackMedium 4.9
Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.
Jun 26, 2026Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.CVE-2026-56068 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.CVE-2026-54189 · affects up to 3.8.10 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.CVE-2026-54188 · affects up to 3.8.10 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.
Jun 17, 2026Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.CVE-2026-54187 · affects up to 3.8.10.1 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.
Jun 17, 2026Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.CVE-2026-52706 · affects up to 3.8.10 · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.
Jun 17, 2026Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.CVE-2026-49084 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.
Jun 17, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49076 · affects up to 3.8.9.1 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.
Jun 17, 2026Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.CVE-2026-49075 · affects up to 3.8.9.1 · reported by PatchstackCritical 9.8
Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.CVE-2026-49074 · affects up to 3.8.9.1 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.
Jun 17, 2026JetEngine: SQL injectionCVE-2026-12360 · affects up to 3.8.10.1 · reported by WordfenceHigh 7.5
The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.
May 25, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42774 · affects up to 3.8.8.1 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue affects JetEngine: from n/a through 3.8.8.1.
Apr 13, 2026JetEngine: SQL InjectionCVE-2026-4352 · affects up to 3.8.6.1 · reported by WordfenceHigh 7.5
The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into a SQL query string via `sprintf()` without sanitization or use of `$wpdb->prepare()`. WordPress REST API's `wp_unslash()` call on `$_GET` strips the `wp_magic_quotes()` protection, allowing single-quote-based injection. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Custom Content Types module must be enabled with at least one CCT configured with a public REST GET endpoint for exploitation.
Mar 24, 2026JetEngine: SQL InjectionCVE-2026-4662 · affects up to 3.8.6.1 · reported by WordfenceHigh 7.5
The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the `prepare_where_clause()` method in the SQL Query Builder not sanitizing the `compare` operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.
Mar 13, 2026JetEngine: Deserialization of Untrusted DataCVE-2026-32355 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.
Mar 5, 2026JetEngine: Improper Control of Generation of Code ('Code Injection')CVE-2026-28134 · affects up to 3.7.2 · reported by PatchstackHigh 8.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.
Feb 20, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68495 · affects up to 3.8.0 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.8.0.
Jan 22, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67923 · affects up to 3.7.7 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7.
Jan 7, 2026JetEngine: Missing AuthorizationCVE-2025-69333 · affects up to 3.8.1.1 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.
Oct 22, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49938 · affects up to 3.7.3 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3.
Aug 20, 2025JetEngine: Insertion of Sensitive Information Into Sent DataCVE-2025-53196 · affects up to 3.7.0 · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embedded Sensitive Data.This issue affects JetEngine: from n/a through <= 3.7.0.
Aug 20, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53195 · affects up to 3.7.0 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.0.
Aug 20, 2025JetEngine: Deserialization of Untrusted DataCVE-2025-53194 · affects up to 3.7.0 · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.
Aug 14, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54688 · affects up to 3.7.1.2 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.1.2.
Apr 15, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26870 · affects up to 3.6.4.1 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through <= 3.6.4.1.
Jan 18, 2025JetEngine: Stored Cross-Site ScriptingCVE-2025-0369 · affects up to 3.6.2 · reported by WordfenceMedium 6.4
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘list_tag’ parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Jan 2, 2025JetEngine: Missing AuthorizationCVE-2023-48758 · affects up to 3.2.4 · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.2.4.
May 17, 2024JetEngine: Improper Privilege ManagementCVE-2023-48757 · affects up to 3.2.4 · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Crocoblock JetEngine allows Privilege Escalation.This issue affects JetEngine: from n/a through 3.2.4.
Apr 10, 2023JetEngine: Includes uploaded files without adequately ensuring that they are not executableCVE-2023-1406 · fixed in 3.1.3.1 · reported by WPScanHigh 8.8
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.