Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-28T16:18:30.340Z",
  "pubdate": "2026-08-28T16:18:30.340Z",
  "executiveSummary": "The Crocoblock JetEngine plugin for WordPress is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. This flaw arises from improper neutralization of user-supplied input during web page generation, allowing attackers to inject malicious scripts into the application's response.\nThe vulnerability affects all versions of JetEngine from n/a through 3.8.14.2. By crafting a malicious URL, an unauthenticated attacker can induce a victim's browser to execute arbitrary JavaScript within the context of the affected site.\nSuccessful exploitation can lead to unauthorized actions, session hijacking, or the redirection of users to malicious websites. The impact is significant as it compromises the integrity of the user's browser session and potentially exposes sensitive authentication tokens or site data.\nThis vulnerability is classified under the CWE-79 category (Improper Neutralization of Input During Web Page Generation). Remediation requires updating the plugin to a patched version once available and implementing robust input validation and output encoding practices.",
  "technicalDetails": "The vulnerability is a classic Reflected Cross-Site Scripting (XSS) flaw occurring due to the application's failure to adequately sanitize or encode user-provided input before reflecting it back to the client's browser within an HTTP response.\nThe root cause lies in the plugin's failure to implement proper output escaping mechanisms for parameters that are dynamically processed and rendered on the frontend. When an attacker includes a malicious payload—typically JavaScript code wrapped in HTML tags like <script> or event handlers—within a vulnerable URL parameter, the server processes the input and includes the unencoded payload in the rendered HTML output.\nThe attack flow begins when an attacker identifies a reflection point within JetEngine's query parameters or input handling logic. The attacker then constructs a crafted URL containing an embedded script. This URL is distributed to a target victim through social engineering, phishing, or by embedding it as a link on a compromised or malicious web page.\nOnce the victim clicks the link, the browser sends an HTTP GET request to the vulnerable endpoint. The server responds with the injected script. Because the application fails to neutralize the payload, the victim's browser executes the script under the security context of the origin (the WordPress site).\nExploitation does not necessarily require the attacker to have administrative privileges, as the reflected nature of the vulnerability targets the end-user's browser. The execution of JavaScript can facilitate unauthorized operations, such as modifying page content, exfiltrating session cookies via document.cookie, performing actions on behalf of the authenticated user (Cross-Site Request Forgery), or capturing sensitive input through DOM manipulation.\nThe vulnerability remains present in all JetEngine iterations from initial release through version 3.8.14.2. Because this is a reflected attack, it relies on the interaction of an authenticated or unauthenticated victim. There is no specific server-side authentication requirement for the attacker, as the vulnerability is triggered by the application's client-side rendering behavior. Persistent exposure is mitigated only by applying secure coding patterns, specifically context-aware output encoding (using WordPress-native functions such as esc_html(), esc_js(), or esc_attr()) at every instance where user input is reflected in the generated HTML document."
}