WordSec
WordSec

JetEngine

Explore JetEngine vulnerabilities across all versions. Currently tracking 31 known vulnerabilities, including severity, impact, and patch status.

01234567891020.03.2023Today20.03.20238.8Crocoblock JetEngine <= 3.1.3 - Authenticated(Author+) Arbitrary File Upload to Remote Code Execution CVSS 8.8 · 20.03.202328.11.20236.3Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization CVSS 6.3 · 28.11.20234.3Multiple Plugins by Crocoblock <= (Various Versions) - Cross-Site Request Forgery CVSS 4.3 · 28.11.20238.8JetEngine <= 3.2.4 - Authenticated (Contributor+) Privilege Escalation CVSS 8.8 · 28.11.20237.1JetEngine <= 3.2.4 - Missing Authorization CVSS 7.1 · 28.11.202317.01.20256.4Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter CVSS 6.4 · 17.01.202511.04.20256.4JetEngine <= 3.6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 11.04.202527.06.20256.4JetEngine <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 27.06.202513.07.20257.5JetEngine <= 3.7.1 - Authenticated (Contributor+) Server-Side Template Injection to Remote Code Execution CVSS 7.5 · 13.07.202516.07.20254.3JetEngine <= 3.7.0 - Authenticated (Subscriber+) Information Exposure CVSS 4.3 · 16.07.202530.07.20256.4JetEngine <= 3.7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 30.07.202518.09.20256.4JetEngine <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 18.09.202530.12.20254.3JetEngine <= 3.8.1.1 - Missing Authorization CVSS 4.3 · 30.12.202505.01.20267.2JetEngine <= 3.7.7 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 05.01.202611.02.20266.1JetEngine <= 3.8.0 - Reflected Cross-Site Scripting CVSS 6.1 · 11.02.202614.02.20267.5JetEngine < 3.8.4.1 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 14.02.202626.02.20268.8JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution CVSS 8.8 · 26.02.202623.03.20267.5JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter CVSS 7.5 · 23.03.202613.04.20267.5JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter CVSS 7.5 · 13.04.202630.04.20267.5JetEngine <= 3.8.8.1 - Unauthenticated SQL Injection CVSS 7.5 · 30.04.202608.06.20267.5JetEngine <= 3.8.9.1 - Unauthenticated SQL Injection CVSS 7.5 · 08.06.20267.2JetEngine <= 3.8.9.1 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 08.06.20267.5JetEngine < 3.8.9.1 - Unauthenticated SQL Injection CVSS 7.5 · 08.06.20267.5JetEngine <= 3.8.9.1 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 08.06.202612.06.20268.1JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection CVSS 8.1 · 12.06.202615.06.20267.5JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection CVSS 7.5 · 15.06.202616.06.20267.5JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint CVSS 7.5 · 16.06.20267.2JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 16.06.20267.2JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 16.06.202625.06.20267.5JetEngine <= 3.8.10.2 - Unauthenticated SQL Injection CVSS 7.5 · 25.06.202622.07.20266.4JetEngine <= 3.8.11 - Authenticated (Contributor+) Sever-Side Request Forgery CVSS 6.4 · 22.07.2026

Strategic Overview

Avg CVSSMedium
7.0/ 10
Patch Coverage100%
Open

0

Fixed

31

Get automatic notifications for all JetEngine vulnerabilities before they are exploited.

Vulnerability Records

31 records
2026-07-22 00:00
JetEngine <= 3.8.11 - Authenticated (Contributor+) Sever-Side Request Forgery
JetEngine
<= 3.8.11
CVE-2026-65467
6.4
Medium
Ananda DhakalYes
2026-06-25 00:00
JetEngine <= 3.8.10.2 - Unauthenticated SQL Injection
JetEngine
<= 3.8.10.2
CVE-2026-56068
7.5
High
Rafie MuhammadYes
2026-06-16 00:00
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
JetEngine
<= 3.8.10.1
CVE-2026-12360
7.5
High
d.v4n_s3cYes
2026-06-16 00:00
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
JetEngine
<= 3.8.10
CVE-2026-54188
7.2
High
VanTasticYes
2026-06-16 00:00
JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
JetEngine
<= 3.8.10
CVE-2026-54189
7.2
High
VanTasticYes
2026-06-15 00:00
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection
JetEngine
<= 3.8.10.1
CVE-2026-54187
7.5
High
VanTasticYes
2026-06-12 00:00
JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection
JetEngine
<= 3.8.10
CVE-2026-52706
8.1
High
VanTasticYes
2026-06-08 00:00
JetEngine <= 3.8.9.1 - Unauthenticated SQL Injection
JetEngine
<= 3.8.9.1
CVE-2026-49076
7.5
High
darooYes
2026-06-08 00:00
JetEngine <= 3.8.9.1 - Unauthenticated Stored Cross-Site Scripting
JetEngine
<= 3.8.9.1
CVE-2026-49074
7.2
High
darooYes
2026-06-08 00:00
JetEngine < 3.8.9.1 - Unauthenticated SQL Injection
JetEngine
< 3.8.9.1
CVE-2026-49084
7.5
High
BondsYes
Showing 1–10 of 31 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C