The fault is a classic unsanitized input flaw that permits attackers to inject arbitrary scripts into the DOM when interacting with the JetEngine plugin. This vulnerability can lead to session hijacking, defacement, or malicious code execution in the context of the victim’s browser. The weakness is known as CWE‑79 – Improper Neutralization of Input During Web Page Generation.

WordPress sites running the Crocoblock JetEngine plugin version 3.8.14.3 or earlier are affected. The flaw exists in the plugin’s default installation and is not tied to a specific WordPress version or theme.

The CVSS score of 7.1 indicates a high severity. Though the EPSS score is not provided, the lack of an explicit mitigation requirement from the vendor implies that exploitation is likely straightforward once the vulnerable plugin is visible. The vulnerability is not currently listed in the CISA KEV catalog. Unauthenticated access appears to be sufficient, so any visitor to the site can potentially trigger the XSS payload. The attack vector includes unsanitized parameters that can be crafted by external users.