Description

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-19T06:17:37.163Z",
  "pubdate": "2026-08-19T06:17:37.163Z",
  "executiveSummary": "The JetEngine WordPress plugin before version 3.8.14 suffers from a Stored Cross-Site Scripting vulnerability arising from the unrestricted addition of SVG to the site-wide allowed upload types without file content sanitization. This flaw allows authenticated users possessing the upload files capability, specifically roles such as Authors, to upload specially crafted Scalable Vector Graphics files containing malicious JavaScript payloads. When an unsuspecting user or administrator opens or views the uploaded SVG file within their browser, the embedded script executes in the context of their session, leading to potential session hijacking, unauthorized actions, or further compromise of the WordPress application. On multisite installations, this improper handling also overrides upload-type restrictions enforced by the network administrator, thereby undermining centralized security controls. The risk implications are severe for environments with untrusted or lower-privileged users assigned the Author role, as exploitation requires only standard authentication and the specific upload capability, bypassing default WordPress media hardening mechanisms.",
  "technicalDetails": "The root cause of the vulnerability resides in the JetEngine plugin's file upload management logic, specifically its handling of site-wide allowed upload types. Prior to version 3.8.14, the plugin programmatically extends the permitted media mime types to include SVG format without implementing subsequent backend sanitization or parsing of the file contents prior to storage. Because SVG files are XML-based documents capable of encapsulating arbitrary executable scripts via tags such as <script> or event handlers like onload, storing them raw introduces severe security risks.\nExploitation of this vulnerability requires authentication with the upload files capability, which is natively granted to the Author role within standard WordPress configurations. The attacker crafts a malicious SVG file containing embedded JavaScript payload designed to execute upon rendering in a web browser. Utilizing the authenticated session, the attacker uploads the malicious file through the standard media upload mechanism handled or influenced by the vulnerable plugin. Because the plugin fails to sanitize or strip potentially dangerous elements from the SVG payload, the file is successfully written to the server's media library.\nThe attack flow proceeds as follows: First, the low-privileged attacker (e.g., an Author) authenticates to the WordPress dashboard. Second, the attacker uploads the crafted malicious SVG payload. Third, the platform accepts and stores the file due to the insecure MIME type addition implemented by JetEngine. Fourth, when any victim—including high-privileged administrators—opens or navigates to the URL of the uploaded SVG file, the browser parses the XML document and executes the embedded JavaScript payload within the security context of the victim's session. The payload behavior can range from executing arbitrary DOM manipulation to stealing session cookies, performing administrative actions via AJAX requests, or injecting persistent backdoors into the application.\nFurthermore, in WordPress multisite configurations, the plugin's enforcement mechanism improperly overrides security restrictions defined by the network administrator regarding disallowed file extensions and permitted upload types. This bypasses centralized hardening measures, exposing all child sites within the network to potential cross-site scripting attacks. Remediation requires updating the JetEngine plugin to version 3.8.14 or later, where proper sanitization or restriction measures are presumably enforced."
}