The JetEngine WordPress plugin (versions before 3.8.12) fails to escape a post meta value when rendering its shortcode, which permits users with Contributor role or higher to inject arbitrary JavaScript into stored content. This vulnerability enables stored cross‑site scripting that runs in the context of higher‑privileged users, such as administrators.

Any WordPress installation that uses the JetEngine plugin with a version earlier than 3.8.12 and allows contributors to publish or edit posts containing the jet_engine shortcode is affected. No other vendors or products are listed.

The exploit requires the ability to create or edit content that includes the plugin’s shortcode, which is available to Contributors and above. Even though the EPSS score is below 1% and the issue is not in the CISA KEV catalog, the potential impact is moderate to high because the injected script runs with the privileges of the target user. The CVSS score of 5.4 indicates a medium severity level. The vulnerability is therefore a high‑risk concern for sites that grant contributors shortcode access but is unlikely to be widely exploited at present.