CVE-2026-18202: Unknown Jetengine

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.

Affected products

• Unknown Jetengine: before 3.8.14 (fixed in 3.8.14)

Published 2026-08-19. Last modified 2026-08-26.