The JetEngine WordPress plugin for Crocoblock and Jetimpex Inc. contains a Subscriber Cross Site Scripting flaw that allows the injection of arbitrary JavaScript into pages rendered for site visitors or subscribers. No authentication is required; the vulnerability is triggered by malicious data stored in subscriber fields that the plugin outputs without proper sanitization. The flaw may be abused to force script execution in a user's browser when the affected content is displayed, compromising the confidentiality and integrity of the site’s interactions.

The flaw affects JetEngine plugin versions 3.8.14.3 and all earlier releases distributed by Crocoblock and Jetimpex Inc. Any WordPress site deploying these plugin versions is vulnerable until the plugin is upgraded to a fixed release (at least 3.8.15).

The CVSS base score of 5.5 indicates moderate severity. An EPSS score is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been reported. Based on the description, it is inferred that the attack vector is remote via the web interface, requiring a caller to insert malicious subscriber data that is later rendered to site visitors, after which the injected script executes in their browsers. No privileged access or multiple‑stage exploitation is required.