Unknown Jetengine vulnerabilities

3 CVEs affecting Unknown Jetengine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18202, published 2026-08-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-18202, published 2026-08-19. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as…
CVE-2026-17019, published 2026-08-10. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated…
CVE-2026-14864, published 2026-08-02. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored…