JetEngine vulnerabilities | LiveThreat CVE Feed

Product

JetEngine

by Crocoblock · last CVE Oct 26, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities22 In the news0 Timeline

Severity mix

Critical 3High 13Medium 6Low 0

Severity

All severities22 Critical3 High13 Medium6 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add JetEngine to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-41844	9.8	1%	Dec 15	Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data Affected: before 2.9.1
CVE-2026-49076	9.3	0%	Jun 17	WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability Affected: through 3.8.9.1
CVE-2026-42774	9.3	0%	May 25	WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability Affected: through 3.8.8.1
CVE-2026-32355	8.8	0%	Mar 13	WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability Affected: through 3.8.4.1
CVE-2026-115608 New	8.5	0%	Oct 26	WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability Affected: through 3.9.0
CVE-2026-28134	8.5	0%	Mar 5	WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability Affected: through 3.7.2
CVE-2025-53194	8.5	0%	Aug 20	WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability Affected: through 3.7.0
CVE-2026-12360	7.5	0%	Jun 17	JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint Affected: through 3.8.10.1
CVE-2026-4352	7.5	0%	Apr 14	JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter Affected: through 3.8.6.1
CVE-2026-4662	7.5	0%	Mar 24	JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter Affected: through 3.8.6.1
CVE-2026-107870	7.1	0%	Oct 14	WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability Affected: through 3.8.16
CVE-2026-97237	7.1	0%	Sep 30	WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability Affected: through 3.8.14.3
CVE-2026-81760	7.1	0%	Aug 28	WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability Affected: through 3.8.14.2
CVE-2025-68495	7.1	0%	Feb 20	WordPress JetEngine plugin <= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 3.8.0
CVE-2025-67923	7.1	0%	Jan 22	WordPress JetEngine plugin <= 3.7.7 - Cross Site Scripting (XSS) vulnerability Affected: through 3.7.7
CVE-2023-48758	7.1	0%	Jan 2	WordPress JetEngine plugin <= 3.2.4 - Broken Access Control vulnerability Affected: through 3.2.4
CVE-2025-49938	6.5	0%	Oct 22	WordPress JetEngine plugin <= 3.7.3 - Cross Site Scripting (XSS) vulnerability Affected: through 3.7.3
CVE-2025-53195	6.5	0%	Aug 20	WordPress JetEngine plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability Affected: through 3.7.0
CVE-2025-53196	6.5	1%	Aug 20	WordPress JetEngine <= 3.7.0 - Sensitive Data Exposure Vulnerability Affected: through 3.7.0
CVE-2025-54688	6.5	0%	Aug 14	WordPress JetEngine Plugin plugin <= 3.7.1.2 - Cross Site Scripting (XSS) Vulnerability Affected: through 3.7.1.2
CVE-2021-38607	5.4	1%	Aug 16	Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input Affected: before 2.6.1
CVE-2025-69333	4.3	0%	Jan 7	WordPress JetEngine plugin <= 3.8.1.1 - Broken Access Control vulnerability Affected: through 3.8.1.1