CyberRota Analysis
AI-GeneratedThe JetEngine WordPress plugin prior to version 3.8.12 is vulnerable to Stored Cross-Site Scripting (XSS) due to inadequate escaping of post meta values in its shortcodes. This flaw allows users with Contributor roles and higher to inject malicious scripts that execute in the context of higher-privileged users, potentially compromising site security. WordPress site administrators and developers using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.