CVE-2026-107870

Deferred Deferred - Pending Action

Cross-Site Scripting in JetEngine WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107870

EUVD

EUVD-2026-101031

Affected Vendors & Products

Vendor	Product	Version / Range
Crocoblock	JetEngine	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a DOM-based Cross-site Scripting (XSS) vulnerability in the Crocoblock JetEngine plugin. It occurs due to improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts into the Document Object Model (DOM) of a webpage.

Detection Guidance

To detect this DOM-based XSS vulnerability in Crocoblock JetEngine, inspect web application traffic for suspicious JavaScript execution or input handling. Check for unusual DOM modifications or injected scripts in browser developer tools. No specific commands are provided in the CVE details.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in a victim's browser, potentially stealing session cookies, redirecting users to malicious sites, or performing actions on their behalf. This could lead to account takeovers or data theft.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines or penalties for failing to protect user data adequately.

Mitigation Strategies

Update JetEngine to version 3.8.16 or later to address the DOM-Based XSS vulnerability. Disable the plugin temporarily if an update is not immediately available.

Hi! I’m here to help you understand CVE-2026-107870. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70