The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting (XSS). When an attacker can inject malicious JavaScript that is persisted by the JetEngine plugin, that script will run in the browser context of any user who visits the affected page, potentially leading to credential theft, malicious redirection, or compromise of the user session. The weakness is classified as CWE‑79 and poses a moderate severity risk.

The flaw affects the Crocoblock JetEngine plugin for WordPress versions up to and including 3.9.0.2. The affected product is JetEngine, which is a popular page building and data management tool within WordPress.

The CVSS base score of 6.5 indicates a moderate level of exploitation risk. No EPSS score is available, so the current probability of exploitation in the wild cannot be quantified. The issue is not listed in the CISA KEV catalog. The attack is a stored XSS, which the likely vector is an input channel that the plugin exposes for data entry—such as custom field definitions or UI elements—wherearbitrary HTML or script can be embedded. If an attacker can craft a request to store malicious code in the plugin or if the plugin renders data without sanitization, the malicious script will execute for every user who views the affected content.