Skip to content
OpenAdvisories

Product · Crocoblock

JetEngine

26 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • High 8.5
    CVE-2026-39736

    WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.

    Crocoblock JetEngine
  • High 8.5
    CVE-2026-115608

    WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.

    Crocoblock JetEngine
  • High 7.1
    CVE-2026-107870

    WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.

    Crocoblock JetEngine
  • High 7.1
    CVE-2026-97237

    WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

    Crocoblock JetEngine
  • High 7.1
    CVE-2026-81760

    WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.

    Crocoblock JetEngine
  • High 7.5
    CVE-2026-12360

    JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint

    The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support…

    Crocoblock JetEngine Web / CMS
  • High 7.5
    CVE-2026-4352

    JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter

    The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into a SQL query…

    Crocoblock JetEngine Web / CMS
  • High 7.5
    CVE-2026-4662

    JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter

    The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing …

    Crocoblock JetEngine Web / CMS
  • High 8.8
    CVE-2026-32355

    WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability

    Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.

    Crocoblock JetEngine
  • High 8.5
    CVE-2026-28134 Public exploit

    WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.

    Crocoblock JetEngine
  • High 7.1
    CVE-2025-68495

    WordPress JetEngine plugin <= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.8.0.

    Crocoblock JetEngine
  • High 7.1
    CVE-2025-67923 Public exploit

    WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7.

    Crocoblock JetEngine
  • High 8.5
    CVE-2025-53194

    WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability

    Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.

    Crocoblock JetEngine
  • High 7.1
    CVE-2023-48758

    WordPress JetEngine plugin <= 3.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.2.4.

    Crocoblock JetEngine
  • High 8.8
    CVE-2023-48757

    WordPress JetEngine plugin <= 3.2.4 - Privilege Escalation vulnerability

    Improper Privilege Management vulnerability in Crocoblock JetEngine allows Privilege Escalation.This issue affects JetEngine: from n/a through 3.2.4.

    Crocoblock JetEngine