CVE-2026-49074: WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability affects the JetEngine WordPress plugin at version 3.8.9.1 and earlier. The flaw is reachable over the network by any unauthenticated attacker, but requires a victim to interact with a crafted link or page for the attack to execute. Successful exploitation lets an attacker run arbitrary JavaScript in the victim's browser, enabling session theft, page defacement, or unauthorized actions taken on the victim's behalf. HarborGuard is tracking the upstream advisory for patch availability and will surface a patched-image rebuild the moment a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious payload over the network, so the affected WordPress installation must be reachable from the attacker's origin.

• AuthenticationNot required

  No account or session credentials are needed; the attack can be launched by any anonymous user.

• Victim interactionRequired

  A victim (typically a logged-in site user or administrator) must follow a crafted link or visit a page hosting the malicious payload for the JavaScript to execute.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions, race conditions, or memory-layout prerequisites are required.

Blast Radius

• Reads the victim's session cookies or authentication tokens, enabling account takeover without the victim's knowledge.
• Reads page content visible to the victim, which may include sensitive configuration details or personal data rendered in the WordPress admin or front-end context.
• Modifies page content in the victim's browser session, allowing the attacker to inject fraudulent UI elements or redirect the victim to attacker-controlled sites.
• Performs actions in the WordPress application on behalf of the victim, such as creating accounts, changing settings, or publishing content, depending on the victim's privilege level.