Skip to content
OpenAdvisories

Product · Crocoblock

JetEngine

26 known vulnerabilities.

JetEngine at a glance

Last 12 months
17
Critical · all time
2
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 2 vulnerabilities February 2026: 1 vulnerability March 2026: 3 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 1 vulnerability, 1 critical June 2026: 2 vulnerabilities, 1 critical Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 1 vulnerability Sep October 2026: 4 vulnerabilities November 2026: 1 vulnerability
Show as table
MonthVulnerabilitiesCritical
Nov 202610
Oct 202640
Sep 202610
Aug 202610
Jul 202600
Jun 202621
May 202611
Apr 202610
Mar 202630
Feb 202610
Jan 202620
Dec 202500
Nov 202500
Oct 202510
Sep 202500
Aug 202540
Jul 202500
Jun 202500
May 202500
Apr 202510
Mar 202500
Feb 202500
Jan 202520
Dec 202400
All Critical High Medium Low Exploited only Public exploit

26 results · Feed

  • Medium 6.5
    CVE-2026-123477

    WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.0.2.

    Crocoblock JetEngine
  • High 8.5
    CVE-2026-39736

    WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2026-39735

    WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.

    Crocoblock JetEngine
  • High 8.5
    CVE-2026-115608

    WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.

    Crocoblock JetEngine
  • High 7.1
    CVE-2026-107870

    WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.

    Crocoblock JetEngine
  • High 7.1
    CVE-2026-97237

    WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

    Crocoblock JetEngine
  • High 7.1
    CVE-2026-81760

    WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.

    Crocoblock JetEngine
  • Critical 9.3
    CVE-2026-49076

    WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.

    Crocoblock JetEngine
  • High 7.5
    CVE-2026-12360

    JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint

    The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support…

    Crocoblock JetEngine Web / CMS
  • Critical 9.3
    CVE-2026-42774

    WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue affects JetEngine: from n/a through 3.8.8.1.

    Crocoblock JetEngine
  • High 7.5
    CVE-2026-4352

    JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter

    The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into a SQL query…

    Crocoblock JetEngine Web / CMS
  • High 7.5
    CVE-2026-4662

    JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter

    The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing …

    Crocoblock JetEngine Web / CMS
  • High 8.8
    CVE-2026-32355

    WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability

    Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.

    Crocoblock JetEngine
  • High 8.5
    CVE-2026-28134 Public exploit

    WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.

    Crocoblock JetEngine
  • High 7.1
    CVE-2025-68495

    WordPress JetEngine plugin <= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.8.0.

    Crocoblock JetEngine
  • High 7.1
    CVE-2025-67923 Public exploit

    WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7.

    Crocoblock JetEngine
  • Medium 4.3
    CVE-2025-69333

    WordPress JetEngine plugin <= 3.8.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2025-49938

    WordPress JetEngine plugin <= 3.7.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2025-53195

    WordPress JetEngine plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.0.

    Crocoblock JetEngine
  • High 8.5
    CVE-2025-53194

    WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability

    Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2025-53196

    WordPress JetEngine <= 3.7.0 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embedded Sensitive Data.This issue affects JetEngine: from n/a through <= 3.7.0.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2025-54688

    WordPress JetEngine Plugin plugin <= 3.7.1.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.1.2.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2025-26870

    WordPress JetEngine plugin <= 3.6.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through <= 3.6.4.1.

    Crocoblock JetEngine
  • Medium 6.4
    CVE-2025-0369

    Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter

    The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘list_tag’ parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attac…

    Crocoblock JetEngine Web / CMS
  • High 7.1
    CVE-2023-48758

    WordPress JetEngine plugin <= 3.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.2.4.

    Crocoblock JetEngine
  • High 8.8
    CVE-2023-48757

    WordPress JetEngine plugin <= 3.2.4 - Privilege Escalation vulnerability

    Improper Privilege Management vulnerability in Crocoblock JetEngine allows Privilege Escalation.This issue affects JetEngine: from n/a through 3.2.4.

    Crocoblock JetEngine