MEDIUM 6.8 NVD

CVE-2026-18202

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with th

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.

References

https://wpscan.com/vulnerability/911d3b5a-0f03-4423-b4b0-84e588c323d8/

Published: 2026-08-19 · Source: NVD · Feed updated: 2026-08-20

This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-08-19 via NVD.

vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.