CVE-2026-97237 in JetEngine Plugin
Summary
by MITRE • 09/30/2026
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an unauthenticated cross-site scripting flaw within JetEngine versions prior to 3.8.14.3 represents a significant security risk for websites utilizing this WordPress plugin ecosystem. Cross-site scripting, commonly referred to by its acronym XSS, is categorized under CWE-79 in the Common Weakness Enumeration standards and falls under the Injection technique of the MITRE ATT&CK framework. This specific instance is particularly severe because it does not require user authentication, allowing any internet-facing visitor with a web browser to exploit the flaw without needing valid credentials or prior interaction with administrative interfaces. The JetEngine plugin serves as an extension for page builders like Elementor and Bricks Builder, enabling developers to create custom post types, taxonomies, forms, and dynamic content loops. Due to its widespread adoption in building complex website architectures, a vulnerability of this nature affects a large surface area of potential targets.
The technical root cause lies in the insufficient sanitization or validation of user-supplied input within specific endpoints exposed by the plugin. When data is submitted through public-facing forms or query parameters processed by JetEngine components such as dynamic listings or form handlers, the application fails to properly neutralize special characters that have meaning in HTML and JavaScript contexts. Consequently, when this maliciously crafted input is reflected back into the web page's response without adequate encoding, it executes arbitrary scripts within the context of the victim’s browser session. This behavior aligns with stored XSS if the data persists in a database or reflected XSS if it appears immediately in the HTTP response, both of which are critical subtypes under CWE-79. The lack of authentication requirement means that an attacker can craft a simple URL payload and distribute it via phishing emails, malicious websites, or social media links to trigger the execution against unsuspecting users who visit the targeted site.
The operational impact of this vulnerability extends beyond mere script execution. Attackers leveraging unauthenticated XSS can perform session hijacking by stealing administrator cookies if they manage to trick an authenticated user into clicking a crafted link while logged in. This could lead to complete compromise of the WordPress dashboard, allowing for further exploitation such as installing backdoors, defacing the website, or exfiltrating sensitive database contents including customer data and credentials. Additionally, attackers can redirect users to malicious phishing sites designed to steal login information or distribute malware through drive-by downloads. The ability to execute scripts in the context of trusted domains also facilitates clickjacking attacks and manipulation of user interactions on the page, undermining the integrity and trustworthiness of the web application. For businesses relying on these websites for e-commerce or lead generation, such incidents can result in substantial financial loss, reputational damage, and non-compliance with data protection regulations like GDPR due to unauthorized access to personal information.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running JetEngine versions 3.8.14.2 and earlier should upgrade to version 3.8.14.3 or later where the input validation mechanisms have been strengthened to properly escape output and sanitize inputs according to OWASP best practices for preventing XSS attacks. In cases where immediate patching is not feasible due to compatibility constraints with other plugins, temporary workarounds include implementing a Web Application Firewall that can detect and block common XSS payloads in HTTP requests. Additionally, enabling Content Security Policy headers on the web server can restrict the sources from which scripts are allowed to execute, thereby mitigating the impact of any successfully injected script by preventing it from accessing sensitive cookies or making unauthorized API calls. Regular security audits and code reviews focusing on input handling within custom post type handlers and form processors are recommended to prevent similar vulnerabilities in future updates or custom integrations involving JetEngine components.