Description

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:32.420Z",
  "pubdate": "2026-08-20T12:16:32.420Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the JetEngine plugin, specifically affecting versions 3.8.14.1 and prior.\nThis security flaw enables remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into vulnerable parameters processed and rendered by the application.\nThe primary impact of this vulnerability includes potential session hijacking, unauthorized access to sensitive application data, credential theft, and defacement or redirection of the affected website.\nThe affected product is JetEngine across all versions up to 3.8.14.1.\nThe risk implications are critical for environments utilizing the plugin, as successful exploitation does not require prior authentication or elevated privileges, lowering the attack barrier significantly.\nAttackers can leverage this vulnerability via crafted HTTP requests directed at exposed endpoints, forcing victims' browsers to execute arbitrary script payloads within the context of the vulnerable origin.",
  "technicalDetails": "The vulnerability exists due to insufficient input sanitization and improper output encoding of user-supplied data handled by the JetEngine plugin in versions <= 3.8.14.1.\nThe root cause stems from the application accepting parameters without adequately validating or escaping characters that possess special meaning in HTML and JavaScript contexts, such as angle brackets and quotation marks.\nNetwork exposure is external, meaning unauthenticated remote attackers can interact directly with the web application endpoints responsible for rendering the vulnerable components.\nAuthentication requirements are nonexistent, as the vulnerability can be triggered via unauthenticated requests, and privilege requirements are similarly absent.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious Uniform Resource Locator (URL) or HTTP request containing a payload consisting of executable JavaScript embedded within vulnerable input vectors processed by JetEngine.\nSecond, the attacker induces a victim, such as an administrative or standard user, to access the malicious link or interact with the crafted endpoint.\nThird, the server processes the request and improperly reflects or stores the input, rendering the unescaped payload directly within the Hypertext Markup Language (HTML) response sent back to the victim's browser.\nFourth, the victim's browser parses the HTTP response and executes the injected script within the security context of the vulnerable domain, bypassing standard same-origin policy constraints regarding the affected application.\nPayload behavior typically involves executing arbitrary JavaScript functions, which can access the Document Object Model (DOM), steal session cookies, capture keystrokes, or perform unauthorized actions on behalf of the authenticated user.\nPost-exploitation impact ranges from complete session compromise to unauthorized administrative actions depending on the privilege level of the victim interacting with the injected payload."
}