The JetEngine WordPress plugin contains a stored cross‑site scripting flaw that occurs when user input provided through custom fields or content entries is not properly neutralized during page rendering. The vulnerability is a classic Input Validation weakness identified as CWE‑79, and it allows an attacker to inject malicious scripts that will run in the browsers of any visitor who views the compromised content. Based on the description, it is inferred that an attacker could exfiltrate session cookies, perform phishing, or deface the site by embedding malicious code visible to all site users.

The flaw impacts the Crocoblock JetEngine WordPress plugin from its earliest releases up through version 3.7.1.2. System administrators who have installed JetEngine 3.7.1.2 or an older release are at risk; newer releases may contain the fix.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% signifies a low probability of current exploitation. The likely attack vector is the plugin’s content editing interface, which typically requires administrative or content‑management privileges to add or edit custom fields. If an attacker gains that ability, they can store malicious script data that will execute for every visitor rendering the affected page. The vulnerability is not listed in the CISA KEV catalog.