Description

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-10T07:16:48.927Z",
  "pubdate": "2026-08-10T07:16:48.927Z",
  "executiveSummary": "The JetEngine WordPress plugin before version 3.8.13.1 suffers from an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability stemming from insecure file upload handling.\nThe flaw allows unauthenticated malicious actors to upload arbitrary Scalable Vector Graphics (SVG) files containing embedded JavaScript without proper input sanitization or strict access control enforcement on upload capabilities.\nWhen a victim, such as an administrator or high-privileged user, accesses the stored SVG file directly via the browser, the malicious script executes within the context of their active session.\nThe primary risk implication includes session hijacking, unauthorized administrative action execution, defacement, and potential site compromise.\nExploitation requires network access to the target WordPress installation and relies on social engineering or direct URL access to the uploaded malicious payload to execute the JavaScript in the context of a targeted user session.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of input sanitization and inadequate restriction enforcement on file upload functionalities within the JetEngine WordPress plugin prior to version 3.8.13.1.\nSVG files are XML-based vector image formats that natively support embedded scripting elements, such as script tags, event handlers (e.g., onload, onerror), and foreignObject elements containing arbitrary executable code.\nBecause the plugin fails to sanitize uploaded SVG contents prior to persistence in storage, raw malicious JavaScript payloads can be written directly into the file structure.\nFurthermore, the application fails to adequately restrict authorization mechanisms, allowing unauthenticated remote attackers to interact with the file upload endpoint.\nThe step-by-step attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious SVG file containing embedded JavaScript payloads designed to execute arbitrary instructions within a browser environment.\nSecond, the attacker transmits this file to the vulnerable WordPress site via the unprotected or inadequately restricted JetEngine upload mechanism.\nThird, the application stores the raw SVG file on the server without executing sanitization routines or stripping dangerous elements and attributes.\nFourth, the attacker or a victim opens the URL pointing to the stored SVG file directly within a web browser.\nFifth, the browser parses the SVG document, interprets the embedded JavaScript payload, and executes the code within the origin context of the target web application.\nBecause execution occurs in the browser of any user who opens the file, post-exploitation impact includes unauthorized API requests, session token theft, DOM manipulation, and secondary payload deployment."
}