VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

JetEngine security & vulnerabilities

jet-engine— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 46 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
46Known vulnerabilities
  • Critical1
  • High27
  • Medium18
  • Low0
Vulnerabilities per year
2023: 5 vulnerabilities5232025: 8 vulnerabilities8252026: 33 vulnerabilities3326

All JetEngine vulnerabilities

JetEngine vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.9.0.2Update to 3.9.1
CVE-2026-123477
Medium6.5Authenticated (Contributor+) SQL Injection
≤3.9.0.1Update to 3.9.0.2
CVE-2026-39736
Medium4.3Missing Authorization
≤3.9.0.1Update to 3.9.0.2
CVE-2026-39735
Medium6.5Authenticated (Contributor+) SQL Injection
≤3.9.0Update to 3.9.0.1
CVE-2026-115608
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.16Update to 3.8.16.1
CVE-2026-107870
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.15.3Update to 3.8.15.4
CVE-2026-97265
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤3.8.14.3Update to 3.8.15
CVE-2026-97238
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.14.3Update to 3.8.15
CVE-2026-97237
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.14.2Update to 3.8.14.3
CVE-2026-81760
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
<3.8.14Update to 3.8.14
CVE-2026-18202
Critical9.8Unauthenticated Remote Code Execution
≤3.8.14Update to 3.8.14.1
CVE-2026-66613
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.14.1Update to 3.8.14.2
CVE-2026-66581
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.13.0Update to 3.8.13.1
CVE-2026-17019
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.13.1Update to 3.8.13.2
CVE-2026-28082
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<3.8.12Update to 3.8.12
CVE-2026-14864
Medium6.4Authenticated (Contributor+) Sever-Side Request Forgery
≤3.8.11Update to 3.8.12
CVE-2026-65467
High7.5Unauthenticated SQL Injection
≤3.8.10.2Update to 3.8.11
CVE-2026-56068
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.10Update to 3.8.10.1
CVE-2026-54189
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.10Update to 3.8.10.1
CVE-2026-54188
High7.5Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
≤3.8.10.1Update to 3.8.10.2
CVE-2026-12360
High7.5Unauthenticated SQL Injection
≤3.8.10.1Update to 3.8.10.2
CVE-2026-54187
High8.1Unauthenticated PHP Object Injection
≤3.8.10Update to 3.8.10.1
CVE-2026-52706
High7.5Unauthenticated SQL Injection
<3.8.9.1Update to 3.8.9.1
CVE-2026-49084
High7.5Unauthenticated SQL Injection
≤3.8.9.1Update to 3.8.10
CVE-2026-49076
High7.5Authenticated (Contributor+) PHP Object Injection
≤3.8.9.1Update to 3.8.10
CVE-2026-49075
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.8.9.1Update to 3.8.10
CVE-2026-49074
High7.5Unauthenticated SQL Injection
≤3.8.8.1Update to 3.8.8.2
CVE-2026-42774
High7.5Unauthenticated SQL Injection via '_cct_search' Parameter
≤3.8.6.1Update to 3.8.6.2
CVE-2026-4352
High7.5Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter
≤3.8.6.1Update to 3.8.6.2
CVE-2026-4662
High8.8Authenticated (Contributor+) Remote Code Execution
≤3.7.2Update to 3.8.1.2
CVE-2026-28134
High7.5Authenticated (Contributor+) PHP Object Injection
<3.8.4.1Update to 3.8.4.1
CVE-2026-32355
Medium6.1Reflected Cross-Site Scripting
≤3.8.0Update to 3.8.1
CVE-2025-68495
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.7.7Update to 3.7.8
CVE-2025-67923
Medium4.3Missing Authorization
≤3.8.1.1Update to 3.8.1.2
CVE-2025-69333
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.7.3Update to 3.7.4
CVE-2025-49938
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.7.1.2Update to 3.7.2
CVE-2025-54688
Medium4.3Authenticated (Subscriber+) Information Exposure
≤3.7.0Update to 3.7.1.1
CVE-2025-53196
High7.5Authenticated (Contributor+) Server-Side Template Injection to Remote Code Execution
≤3.7.1Update to 3.7.1.1
CVE-2025-53194
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.7.0Update to 3.7.1.1
CVE-2025-53195
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.6.4.1Update to 3.6.5
CVE-2025-26870
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter
≤3.6.2Update to 3.6.3
CVE-2025-0369
High7.1Missing Authorization
≤3.2.4Update to 3.2.5
CVE-2023-48758
Medium6.3Missing Authorization
≤3.2.2Update to 3.2.2.1
CVE-2023-48761
Medium4.3Cross-Site Request Forgery
≤3.2.2Update to 3.2.2.1
CVE-2023-48762
High8.8Authenticated (Contributor+) Privilege Escalation
≤3.2.4Update to 3.2.5
CVE-2023-48757
High8.8Authenticated(Author+) Arbitrary File Upload to Remote Code Execution
≤3.1.3Update to 3.1.3.1
CVE-2023-1406

JetEngine: common questions

Does JetEngine have known vulnerabilities?

Yes. VulnCrest Radar lists 46 known vulnerabilities in JetEngine: 1 critical, 27 high, 18 medium. None are known to affect version null.

How do I check which version of JetEngine I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent JetEngine vulnerability?

CVE-2026-123477, published Nov 7, 2026: JetEngine <= 3.9.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any JetEngine vulnerability listed in CISA KEV?

No. None of the known JetEngine vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?