{"id":"CVE-2026-123477","kind":"vulnerability","aliases":["CVE-2026-123477"],"related":[],"title":"JetEngine WordPress plugin: stored XSS through 3.9.0.2","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.0.2.","summary":"JetEngine, a WordPress plugin by Crocoblock, fails to neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can store crafted content can run scripts in other users' browsers, such as an administrator's session.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetengine","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed JetEngine plugin version in the WordPress admin under Plugins; the sources say versions through 3.9.0.2 are affected.\n- Confirm whether the plugin is active on the site.","fix":null,"status":"open","published_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","triaged_at":"2026-11-07T13:49:16+00:00","updated_at":"2026-11-07T13:49:16+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T13:49:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"JetEngine WordPress plugin: stored XSS through 3.9.0.2","impact":"medium","summary":"JetEngine, a WordPress plugin by Crocoblock, fails to neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can store crafted content can run scripts in other users' browsers, such as an administrator's session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","jetengine","crocoblock"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in other users' browsers, possibly admin sessions","analyst_note":"Find the fixed JetEngine version and the vulnerable input path in the Wordfence or Crocoblock advisory; NVD gives only the affected range.","how_to_check":"- Check the installed JetEngine plugin version in the WordPress admin under Plugins; the sources say versions through 3.9.0.2 are affected.\n- Confirm whether the plugin is active on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the JetEngine plugin for WordPress at or below 3.9.0.2 are affected. The sources do not say which JetEngine features or configurations make the stored input reachable, so the exposure of any given site is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4219,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123477':10A,13A '-2026':9A,12A '3.9.0.2':7A,85C 'administr':54B 'affect':80C 'allow':31B,76C 'attack':38B 'browser':50B 'content':43B 'craft':42B 'crocoblock':14B,23B,71C 'cross':34B,66C 'cross-sit':33B,65C 'cve':8A,11A 'engin':75C 'fail':24B 'generat':29B,64C 'improp':57C 'input':27B,60C 'issu':79C 'jet':74C 'jet-engin':73C 'jetengin':1A,15B,18B,72C,81C 'n/a':83C 'neutral':26B,58C 'packag':16B 'page':30B,63C 'plugin':3A,21B 'run':45B 'script':36B,46B,68C 'session':56B 'site':35B,67C 'store':4A,32B,41B,77C 'user':49B 'vulner':69C 'web':62C 'wordpress':2A,17B,20B 'xss':5A 'xss.this':78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetEngine plugin for WordPress at or below 3.9.0.2 are affected. The sources do not say which JetEngine features or configurations make the stored input reachable, so the exposure of any given site is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crocoblock","jetengine","medium","package","wordpress"],"campaign_type":null,"search_a":"'-123477':10A,13A '-2026':9A,12A '3.9.0.2':7A 'cve':8A,11A 'jetengin':1A 'plugin':3A 'store':4A 'wordpress':2A 'xss':5A","search_b":"'administr':54B 'allow':31B 'attack':38B 'browser':50B 'content':43B 'craft':42B 'crocoblock':14B,23B 'cross':34B 'cross-sit':33B 'fail':24B 'generat':29B 'input':27B 'jetengin':15B,18B 'neutral':26B 'packag':16B 'page':30B 'plugin':21B 'run':45B 'script':36B,46B 'session':56B 'site':35B 'store':32B,41B 'user':49B 'wordpress':17B,20B","search_c":"'3.9.0.2':85C 'affect':80C 'allow':76C 'crocoblock':71C 'cross':66C 'cross-sit':65C 'engin':75C 'generat':64C 'improp':57C 'input':60C 'issu':79C 'jet':74C 'jet-engin':73C 'jetengin':72C,81C 'n/a':83C 'neutral':58C 'page':63C 'script':68C 'site':67C 'store':77C 'vulner':69C 'web':62C 'xss.this':78C","first_public_at":"2026-11-07T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123477","severity":null,"published_at":"2026-11-07T13:16:37+00:00","modified_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","fetched_at":"2026-11-07T13:47:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}