Cross-Site Scripting
10 records32.3%First: 2025. Latest: 2026.
Plugin security history
JetEngine Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with JetEngine, published between 2023 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
31Total records
0Critical
20High
11Medium
0Low
0Informational
31Patched records
0Currently marked unpatched
2023-03-20First disclosure
2026-07-22Latest disclosure
31 of 31CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2023 | 5 | |
| 2025 | 8 | |
| 2026 | 18 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| High | 20 | 64.5% |
| Medium | 11 | 35.5% |
Vulnerability-Type Breakdown
SQL Injection
8 records25.8%First: 2026. Latest: 2026.
Other
6 records19.4%First: 2025. Latest: 2026.
Missing Authorization
3 records9.7%First: 2023. Latest: 2025.
Arbitrary File Upload
1 record3.2%First: 2023. Latest: 2023.
CSRF
1 record3.2%First: 2023. Latest: 2023.
Privilege Escalation
1 record3.2%First: 2023. Latest: 2023.
Information Disclosure
1 record3.2%First: 2025. Latest: 2025.
Patch Status
- Patched
- 31
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
3.8.123.8.113.8.10.13.8.10.23.8.103.8.9.13.8.8.23.8.6.23.8.4.13.8.13.7.83.8.1.23.7.43.7.23.7.1.13.6.53.6.33.2.53.2.5.23.1.3.1
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-3.6.2 | Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter | January 17, 2025 | 3.6.3 | Medium |
*-3.2.4 | JetEngine <= 3.2.4 - Authenticated (Contributor+) Privilege Escalation | November 28, 2023 | 3.2.5 | High |
*-3.2.5.1 | Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization | November 28, 2023 | 3.2.5.2 | Medium |
*-3.2.4 | JetEngine <= 3.2.4 - Missing Authorization | November 28, 2023 | 3.2.5 | High |
*-3.2.5.1 | Multiple Plugins by Crocoblock <= (Various Versions) - Cross-Site Request Forgery | November 28, 2023 | 3.2.5.2 | Medium |
*-3.1.3 | Crocoblock JetEngine <= 3.1.3 - Authenticated(Author+) Arbitrary File Upload to Remote Code Execution | March 20, 2023 | 3.1.3.1 | High |
Selected source records
Latest Records
MediumCVE-2026-65467
JetEngine <= 3.8.11 - Authenticated (Contributor+) Sever-Side Request Forgery
Published: July 22, 2026
- Affected versions
- *-3.8.11
- Patched versions
- 3.8.12
HighCVE-2026-56068
JetEngine <= 3.8.10.2 - Unauthenticated SQL Injection
Published: June 25, 2026
- Affected versions
- *-3.8.10.2
- Patched versions
- 3.8.11
HighCVE-2026-54189
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
Published: June 16, 2026
- Affected versions
- *-3.8.10
- Patched versions
- 3.8.10.1
HighCVE-2026-54188
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
Published: June 16, 2026
- Affected versions
- *-3.8.10
- Patched versions
- 3.8.10.1
HighCVE-2026-12360
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
Published: June 16, 2026
- Affected versions
- *-3.8.10.1
- Patched versions
- 3.8.10.2
HighCVE-2026-54187
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection
Published: June 15, 2026
- Affected versions
- *-3.8.10.1
- Patched versions
- 3.8.10.2
HighCVE-2026-52706
JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection
Published: June 12, 2026
- Affected versions
- *-3.8.10
- Patched versions
- 3.8.10.1
HighCVE-2026-49084
JetEngine < 3.8.9.1 - Unauthenticated SQL Injection
Published: June 8, 2026
- Affected versions
- [*, 3.8.9.1)
- Patched versions
- 3.8.9.1
Highest-Severity Records
HighCVE-2026-28134
JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution
Published: February 26, 2026
- Affected versions
- *-3.7.2
- Patched versions
- 3.8.1.2
HighCVE-2023-48757
JetEngine <= 3.2.4 - Authenticated (Contributor+) Privilege Escalation
Published: November 28, 2023
- Affected versions
- *-3.2.4
- Patched versions
- 3.2.5
HighCVE-2023-1406
Crocoblock JetEngine <= 3.1.3 - Authenticated(Author+) Arbitrary File Upload to Remote Code Execution
Published: March 20, 2023
- Affected versions
- *-3.1.3
- Patched versions
- 3.1.3.1
HighCVE-2026-52706
JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection
Published: June 12, 2026
- Affected versions
- *-3.8.10
- Patched versions
- 3.8.10.1
HighCVE-2026-56068
JetEngine <= 3.8.10.2 - Unauthenticated SQL Injection
Published: June 25, 2026
- Affected versions
- *-3.8.10.2
- Patched versions
- 3.8.11
HighCVE-2026-4352
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter
Published: April 13, 2026
- Affected versions
- *-3.8.6.1
- Patched versions
- 3.8.6.2
HighCVE-2026-54187
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection
Published: June 15, 2026
- Affected versions
- *-3.8.10.1
- Patched versions
- 3.8.10.2
HighCVE-2026-49084
JetEngine < 3.8.9.1 - Unauthenticated SQL Injection
Published: June 8, 2026
- Affected versions
- [*, 3.8.9.1)
- Patched versions
- 3.8.9.1
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.