Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

JetEngine — Vulnerabilities & Security Advisories 45

All 45 CVE vulnerabilities found in JetEngine, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting the JetEngine plugin, a WordPress extension developed by Crocoblock, specifically focusing on code execution and privilege escalation weaknesses. The collection encompasses a comprehensive range of reported issues discovered between the plugin's initial public release and the current date, including remote code execution, cross-site scripting, and unauthorized access flaws. Visitors can utilize this resource to track the vendor's historical security advisories, analyze the characteristics of specific weakness classes prevalent in WordPress ecosystem extensions, or review the complete vulnerability timeline for JetEngine to assess long-term risk. The data presented here serves as a centralized reference for security researchers, system administrators, and developers who need to understand the security posture of this specific product without navigating multiple fragmented sources. By consolidating these findings, the page facilitates efficient impact analysis and helps organizations prioritize remediation efforts based on the severity and nature of the disclosed defects. This aggregation supports proactive security management by providing clear visibility into how the product has evolved from a security perspective over time. Users seeking to maintain secure WordPress environments will find this historical record essential for making informed decisions regarding plugin deployment, updates, and potential replacement strategies.

Vendor: Unknown

CVE ID Title CVSS Severity Published
CVE-2026-125785 WordPress JetEngine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2026-11-12
CVE-2026-123477 WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2026-11-07
CVE-2026-39736 WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability CWE-89 8.5 High 2026-10-29
CVE-2026-39735 WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability CWE-862 6.5 Medium 2026-10-29
CVE-2026-115608 WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability CWE-89 8.5 High 2026-10-26
CVE-2026-107870 WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-10-14
CVE-2026-97265 WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2026-09-30
CVE-2026-97238 WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability CWE-79 5.5 Medium 2026-09-30
CVE-2026-97237 WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-09-30
CVE-2026-81760 WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-08-28
CVE-2026-66581 WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-08-20
CVE-2026-66613 WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability CWE-1336 9.8 Critical 2026-08-19
CVE-2026-18202 JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload - - 2026-08-19
CVE-2026-17019 JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) - - 2026-08-10
CVE-2026-28082 WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-08-06
CVE-2026-14864 JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode - - 2026-08-02
CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability CWE-918 4.9 Medium 2026-07-23
CVE-2026-56068 WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability CWE-89 9.3 Critical 2026-06-26
CVE-2026-54189 WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-06-17
CVE-2026-54188 WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-06-17
CVE-2026-54187 WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability CWE-89 9.3 Critical 2026-06-17
CVE-2026-52706 WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability CWE-502 9.8 Critical 2026-06-17
CVE-2026-49084 WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability CWE-89 9.3 Critical 2026-06-17
CVE-2026-49076 WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability CWE-89 9.3 Critical 2026-06-17
CVE-2026-49075 WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability CWE-502 9.8 Critical 2026-06-17
CVE-2026-49074 WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-06-17
CVE-2026-12360 JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint CWE-89 7.5 High 2026-06-17
CVE-2026-42774 WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability CWE-89 9.3 Critical 2026-05-25
CVE-2026-4352 JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter CWE-89 7.5 High 2026-04-14
CVE-2026-4662 JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter CWE-89 7.5 High 2026-03-24

All 45 known CVE vulnerabilities affecting JetEngine with full Chinese analysis, references, and POCs where available.