CVE-2026-107870
7.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser session to steal credentials or hijack accounts. This requires an unauthenticated attacker to trick a user into clicking a crafted link.
Root cause
Improper input neutralization allows client-side data to be written directly into the DOM without sanitization, triggering DOM-based cross-site scripting.
Affected systems
Crocoblock JetEngine plugin for WordPress through 3.8.16
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade JetEngine to a version newer than 3.8.16 once available. If patching must wait, temporarily deactivate the JetEngine plugin or restrict access via a WAF rule blocking suspicious query parameters.
$ wp plugin update jet-engineAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.