The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting (XSS) in the JetEngine plugin. An attacker could inject malicious scripts that are persisted in plugin fields and executed when a page is rendered, potentially leading to session hijacking, data theft, or defacement. The weakness corresponds to CWE‑79, a classic input validation failure.

Vendor Crocoblock JetEngine is affected in all versions from the first release through and including 3.7.0. No higher‑numbered versions are impacted, so any installation running a version equal to or older than 3.7.0 is vulnerable.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation remains low. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through stored input—such as custom fields or form entries—created by the plugin, which is later rendered without sanitization and executed in users’ browsers.