CVE-2026-54188: WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored cross-site scripting (XSS) vulnerability in the JetEngine WordPress plugin, versions 3.8.10 and earlier. The flaw is reachable over the network by any unauthenticated user, but requires a victim to interact with a crafted link or page, based on the CVSS vector. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser context, enabling session theft, page content manipulation, and degradation of service availability. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment an upstream fix becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can send a crafted request from anywhere on the internet without needing local or adjacent-network access.

• AuthenticationNot required

  No account or credentials of any kind are needed to trigger the vulnerability; the attack is available to completely anonymous users.

• Victim interactionRequired

  A victim must follow a crafted link or visit a manipulated page for the malicious script payload to execute in their browser, making social engineering a necessary step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental pre-conditions beyond delivering the crafted input.

Blast Radius

• An attacker can steal session cookies or authentication tokens from the victim's browser, enabling account takeover without needing the victim's credentials.
• Arbitrary JavaScript execution allows the attacker to modify visible page content, redirect the victim to a phishing site, or silently submit forms on the victim's behalf.
• Confidential data rendered in the browser at the time of exploitation, such as personal profile details or administrative configuration, can be exfiltrated to an attacker-controlled endpoint.
• The injected script can degrade or disrupt the victim's experience of the affected WordPress site, consistent with the low availability impact noted in the CVSS vector.