CVE-2026-54189: WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability exists in the JetEngine WordPress plugin at version 3.8.10 and earlier. The flaw is reachable over the network without authentication, but requires a victim to interact with a crafted link or page, which classifies it as a social-engineering-dependent attack. Successful exploitation allows an attacker to inject and run arbitrary JavaScript in the victim's browser, enabling session theft, content modification, and limited disruption of the affected page. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target WordPress installation over the network; there is no local or physical access requirement.

• AuthenticationNot required

  No account or credentials on the target site are needed to deliver the malicious payload.

• Victim interactionRequired

  A victim (typically a logged-in user or administrator) must click a crafted link or visit a malicious page for the injected script to execute in their browser.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim is social-engineered; no race conditions or special environmental factors are required.

Blast Radius

• An attacker can steal the victim's session cookie or authentication token and replay it to act as that user, including as an administrator.
• Arbitrary JavaScript running in the victim's browser can read and exfiltrate any data visible on the page, such as personal information or site configuration details.
• The injected script can modify page content the victim sees, redirecting form submissions or displaying fraudulent content.
• Browser-side disruption can degrade or break the page's functionality for the victim during the session.