Improper Neutralization of Input During Web Page Generation (CWE‑79) gives an attacker the ability to inject and execute arbitrary JavaScript in the visitor’s browser when a WordPress site runs JetEngine up to version 3.8.14.3. The flaw is a classic DOM‑based XSS that renders unsanitized input directly into the page’s client‑side code. Successful exploitation can lead to credential theft, defacement, or other malicious actions performed under the victim’s authenticated session. The weakness is fully reflected in the CVE description and is widely reproduced in plugin installations.

Any WordPress site that has installed the Crocoblock JetEngine plugin at version 3.8.14.3 or earlier is affected. The problem exists regardless of the WordPress core or theme version because it resides in the plugin’s core code.

The CVSS score of 7.1 indicates a high severeness. The EPSS score is less than 1%, implying that exploitation attempts are rare at this time, though the widespread usage of JetEngine makes it a valid target. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is any external user who can influence the data flow that JetEngine processes; the plugin does not perform input sanitization, so the attacker can create a malicious URL or form input and invite victims to visit the vulnerable page. This means that authentication is not required for exploitation, and a simple crafted request can trigger the payload.