Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

JetEngine — Vulnerabilities & Security Advisories 30

All 30 CVE vulnerabilities found in JetEngine, with AI-generated Chinese analysis, references, and POCs.

This page catalogs known security vulnerabilities affecting JetEngine, a popular WordPress plugin developed by Crocoblock, categorized under weakness types such as improper input validation and insecure direct object references. It aggregates a comprehensive list of Common Vulnerabilities and Exposures (CVE) entries that have been publicly disclosed or assigned by various security tracking organizations. The collection spans from the plugin’s initial release phases through recent updates, ensuring a historical perspective on security incidents ranging from early beta versions to current stable releases. Readers can utilize this resource to track Crocoblock’s official advisory responses and patch deployment timelines, allowing for a clearer understanding of how the vendor addresses reported flaws. Furthermore, users can analyze specific weakness classes to understand the technical nature of the exploits, such as cross-site scripting or privilege escalation, within the context of JetEngine’s architecture. The page also serves as a lookup tool for individual product versions, enabling developers and site administrators to review the complete vulnerability history of their specific deployment environment. By examining the timeline of disclosed issues, stakeholders can better assess risk exposure and prioritize updates. This aggregation aids in maintaining transparency regarding the security posture of the software ecosystem, supporting informed decision-making for integration and maintenance strategies without relying on marketing narratives or speculative claims.

Vendor: Unknown

CVE IDTitleCVSSSeverityPublished
CVE-2026-14864 JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode --2026-08-02
CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability CWE-918 4.9 Medium2026-07-23
CVE-2026-56068 WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability CWE-89 9.3 Critical2026-06-26
CVE-2026-54189 WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High2026-06-17
CVE-2026-54188 WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High2026-06-17
CVE-2026-54187 WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability CWE-89 9.3 Critical2026-06-17
CVE-2026-52706 WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability CWE-502 9.8 Critical2026-06-17
CVE-2026-49084 WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability CWE-89 9.3 Critical2026-06-17
CVE-2026-49076 WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability CWE-89 9.3 Critical2026-06-17
CVE-2026-49075 WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability CWE-502 9.8 Critical2026-06-17
CVE-2026-49074 WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High2026-06-17
CVE-2026-12360 JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint CWE-89 7.5 High2026-06-17
CVE-2026-42774 WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability CWE-89 9.3 Critical2026-05-25
CVE-2026-4352 JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter CWE-89 7.5 High2026-04-14
CVE-2026-4662 JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter CWE-89 7.5 High2026-03-24
CVE-2026-32355 WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability CWE-502 8.8 High2026-03-13
CVE-2026-28134 WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability CWE-94 8.5 High2026-03-05
CVE-2025-68495 WordPress JetEngine plugin <= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High2026-02-20
CVE-2025-67923 WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High2026-01-22
CVE-2025-69333 WordPress JetEngine plugin <= 3.8.1.1 - Broken Access Control vulnerability CWE-862 4.3 Medium2026-01-07
CVE-2025-49938 WordPress JetEngine plugin <= 3.7.3 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium2025-10-22
CVE-2025-53194 WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability CWE-82 8.5 High2025-08-20
CVE-2025-53195 WordPress JetEngine plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability CWE-79 6.5 Medium2025-08-20
CVE-2025-53196 WordPress JetEngine <= 3.7.0 - Sensitive Data Exposure Vulnerability CWE-201 6.5 Medium2025-08-20
CVE-2025-54688 WordPress JetEngine Plugin plugin <= 3.7.1.2 - Cross Site Scripting (XSS) Vulnerability CWE-79 6.5 Medium2025-08-14
CVE-2025-26870 WordPress JetEngine plugin <= 3.6.4.1 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium2025-04-15
CVE-2025-0369 Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter CWE-79 6.4 Medium2025-01-18
CVE-2023-48758 WordPress JetEngine plugin <= 3.2.4 - Broken Access Control vulnerability CWE-862 7.1 High2025-01-02
CVE-2023-48757 WordPress JetEngine plugin <= 3.2.4 - Privilege Escalation vulnerability CWE-269 8.8 High2024-05-17
CVE-2023-1406 JetEngine < 3.1.3.1 - Author+ Remote Code Execution 9.8 -2023-04-10

All 30 known CVE vulnerabilities affecting JetEngine with full Chinese analysis, references, and POCs where available.