CVE-2026-49076

The JetEngine plugin by Crocoblock (up to version 3.9.0.1) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Crocoblock JetEngine WordPress plugin in versions up to 3.9.0 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This may allow an attacker to inject malicious SQL code.

Cross Site Scripting (XSS) vulnerability in JetEngine up to version 3.8.14.3. A subscriber can inject malicious scripts.

Unauthenticated remote code execution (RCE) vulnerability in JetEngine plugin versions up to and including 3.8.14. An attacker can execute arbitrary code on the server without logging in.

The JetEngine plugin for WordPress versions 3.8.10.2 and earlier contains an SQL injection vulnerability that can be exploited by an unauthenticated attacker. This vulnerability allows unauthorized database queries to be executed.

There is an unauthenticated SQL injection vulnerability in JetEngine versions <= 3.8.10.1.

There is an unauthenticated PHP object injection vulnerability in JetEngine versions up to 3.8.10.

JetEngine versions below 3.8.9.1 are vulnerable to unauthenticated SQL injection.

JetEngine versions up to 3.8.9.1 are vulnerable to PHP Object Injection, which may lead to unauthorized access to data.

The JetEngine plugin for WordPress by Crocoblock is vulnerable to SQL Injection. The issue affects all versions up to and including 3.8.8.1. Improper neutralization of special elements used in SQL commands allows an attacker to execute arbitrary SQL queries.