CVE-2026-17019
Received Received - Intake

Stored XSS in JetEngine WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-17019
EUVD
EUVD-2026-55034

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetengine jetengine to 3.8.13.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the JetEngine WordPress plugin before version 3.8.13.1. It allows unauthenticated attackers to upload malicious SVG files containing JavaScript code. When these files are viewed by any user, the embedded JavaScript executes in their browser.

Detection Guidance

Check for unauthenticated SVG upload forms in WordPress sites using JetEngine plugin versions before 3.8.13.1. Inspect network traffic for suspicious file uploads to /wp-content/uploads/ directories. Look for unexpected JavaScript execution in SVG files served from the site.

Impact Analysis

An attacker could steal user sessions, deface websites, or perform actions on behalf of users. Users viewing the malicious SVG file would unknowingly execute the attacker's JavaScript code in their browsers.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. It may result in data breaches or unauthorized processing of personal data.

Mitigation Strategies

Update the JetEngine plugin to version 3.8.13.1 or later immediately. Disable SVG uploads in forms if not required. Restrict file upload permissions to authenticated users only. Implement strict file type validation for uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17019. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart