Description

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:16:51.770Z",
  "pubdate": "2026-08-06T15:16:51.770Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the JetEngine plugin, affecting versions up to and including 3.8.13.1. This security flaw enables remote, unauthenticated threat actors to inject malicious JavaScript payloads into vulnerable parameters processed by the application. Upon successful execution within a victim's browser context, the injected scripts execute with the privileges of the user session, potentially leading to unauthorized actions, session hijacking, credential theft, and the defacement or manipulation of rendered web pages.\nThe risk implications are severe for deployments utilizing affected JetEngine versions due to the lack of authentication requirements, allowing any external attacker over the network to interact with the target endpoint without prior privileges or system access. Exploitation relies on the application failing to properly sanitize or encode user-supplied input before rendering it back to the client. Consequently, organizations operating the JetEngine plugin face significant exposure to client-side attacks, necessitating immediate remediation actions to secure affected systems against potential exploitation vectors.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the JetEngine plugin for versions <= 3.8.13.1. Specifically, the application fails to enforce contextual output encoding or rigorous input sanitization on parameters processed by the affected component. Because the vulnerability is unauthenticated, no valid session tokens, credentials, or specific privilege levels are required by the threat actor to initiate the attack flow.\nThe attack vector is network-based, allowing an external adversary to craft a malicious HTTP request containing a payload composed of HTML or JavaScript tags. When an unsuspecting user or administrator subsequently visits the compromised endpoint or interacts with the dynamically generated content, the server reflects the unsanitized input back into the Document Object Model (DOM) without adequate neutralization.\nThe payload behavior involves the browser parsing the malicious response as executable script content rather than inert text data. Depending on the exact nature of the injected payload, the script executes immediately within the context of the victim's authenticated session. Post-exploitation impact encompasses unauthorized DOM manipulation, redirection to malicious external domains, theft of sensitive cookies and session identifiers, and the potential escalation of privileges via targeted interaction with administrative interfaces if an administrative user falls victim to the exploit."
}