JetEngine

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   JetEngine

Information

Software Type Plugin
Software Slug jet-engine
Software Status Active
Software Author Crocoblock
Software Website crocoblock.com
Software Record Last Updated June 16, 2025

Showing 1-20 of 31 Vulnerabilities

Submit a Vulnerability
JetEngine <= 3.8.11 - Authenticated (Contributor+) Sever-Side Request Forgery
6.4
CVE-2026-65467
Jul 22, 2026
Researcher: Ananda Dhakal
JetEngine <= 3.8.10.2 - Unauthenticated SQL Injection
7.5
CVE-2026-56068
Jun 25, 2026
Researcher: Rafie Muhammad
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-54188
Jun 16, 2026
Researcher: VanTastic
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-54189
Jun 16, 2026
Researcher: VanTastic
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
7.5
CVE-2026-12360
Jun 16, 2026
Researcher: d.v4n_s3c
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection
7.5
CVE-2026-54187
Jun 15, 2026
Researcher: VanTastic
JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection
8.1
CVE-2026-52706
Jun 12, 2026
Researcher: VanTastic
JetEngine < 3.8.9.1 - Unauthenticated SQL Injection
7.5
CVE-2026-49084
Jun 8, 2026
Researcher: Bonds
JetEngine <= 3.8.9.1 - Unauthenticated SQL Injection
7.5
CVE-2026-49076
Jun 8, 2026
Researcher: daroo
JetEngine <= 3.8.9.1 - Authenticated (Contributor+) PHP Object Injection
7.5
CVE-2026-49075
Jun 8, 2026
Researcher: daroo
JetEngine <= 3.8.9.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-49074
Jun 8, 2026
Researcher: daroo
JetEngine <= 3.8.8.1 - Unauthenticated SQL Injection
7.5
CVE-2026-42774
Apr 30, 2026
Researcher: daroo
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter
7.5
CVE-2026-4352
Apr 13, 2026
Researcher: h0xilo
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter
7.5
CVE-2026-4662
Mar 23, 2026
Researcher: h0xilo
JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution
8.8
CVE-2026-28134
Feb 26, 2026
Researcher: stealthcopter
JetEngine < 3.8.4.1 - Authenticated (Contributor+) PHP Object Injection
7.5
CVE-2026-32355
Feb 14, 2026
Researcher: Phat RiO
JetEngine <= 3.8.0 - Reflected Cross-Site Scripting
6.1
CVE-2025-68495
Feb 11, 2026
Researcher: Bonds
JetEngine <= 3.7.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-67923
Jan 5, 2026
Researcher: Bonds
JetEngine <= 3.8.1.1 - Missing Authorization
4.3
CVE-2025-69333
Dec 30, 2025
Researcher: Bonds
JetEngine <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-49938
Sep 18, 2025
Researcher: stealthcopter
Title Status CVE ID CVSS Researchers Date
JetEngine <= 3.8.11 - Authenticated (Contributor+) Sever-Side Request Forgery Patched CVE-2026-65467 6.4 Ananda Dhakal July 22, 2026
JetEngine <= 3.8.10.2 - Unauthenticated SQL Injection Patched CVE-2026-56068 7.5 Rafie Muhammad June 25, 2026
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-54188 7.2 VanTastic June 16, 2026
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-54189 7.2 VanTastic June 16, 2026
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint Patched CVE-2026-12360 7.5 d.v4n_s3c June 16, 2026
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection Patched CVE-2026-54187 7.5 VanTastic June 15, 2026
JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection Patched CVE-2026-52706 8.1 VanTastic June 12, 2026
JetEngine < 3.8.9.1 - Unauthenticated SQL Injection Patched CVE-2026-49084 7.5 Bonds June 8, 2026
JetEngine <= 3.8.9.1 - Unauthenticated SQL Injection Patched CVE-2026-49076 7.5 daroo June 8, 2026
JetEngine <= 3.8.9.1 - Authenticated (Contributor+) PHP Object Injection Patched CVE-2026-49075 7.5 daroo June 8, 2026
JetEngine <= 3.8.9.1 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-49074 7.2 daroo June 8, 2026
JetEngine <= 3.8.8.1 - Unauthenticated SQL Injection Patched CVE-2026-42774 7.5 daroo April 30, 2026
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter Patched CVE-2026-4352 7.5 h0xilo April 13, 2026
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter Patched CVE-2026-4662 7.5 h0xilo March 23, 2026
JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution Patched CVE-2026-28134 8.8 stealthcopter February 26, 2026
JetEngine < 3.8.4.1 - Authenticated (Contributor+) PHP Object Injection Patched CVE-2026-32355 7.5 Phat RiO February 14, 2026
JetEngine <= 3.8.0 - Reflected Cross-Site Scripting Patched CVE-2025-68495 6.1 Bonds February 11, 2026
JetEngine <= 3.7.7 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2025-67923 7.2 Bonds January 5, 2026
JetEngine <= 3.8.1.1 - Missing Authorization Patched CVE-2025-69333 4.3 Bonds December 30, 2025
JetEngine <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-49938 6.4 stealthcopter September 18, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation