CVE-2026-18202
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitizing file contents, allowing users with upload capability, such as Authors, to upload files containing malicious JavaScript that executes in the browser of any user who opens it (Stored XSS). On multisite, this also overrides an upload-type restriction set by the network administrator.
Risk Assessment
Malicious JavaScript can steal user data, hijack sessions, or spread malware.
Recommendation
Update the JetEngine plugin to version 3.8.14 or later, which includes SVG sanitization fixes.
Original NVD description (English source)
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.