+ 22 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2026-49076
|
JetEngine [jet-engine] < 3.8.10 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Crítica
9,3
|
< 3.8.10
|
3.8.10 |
2026-06-08 |
—
|
|
CVE-2026-49084
|
JetEngine [jet-engine] < 3.8.9.1 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Crítica
9,3
|
< 3.8.9.1
|
3.8.9.1 |
2026-06-08 |
—
|
|
CVE-2026-42774
|
JetEngine [jet-engine] < 3.8.8.2 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Crítica
9,3
|
< 3.8.8.2
|
3.8.8.2 |
2026-04-30 |
—
|
|
CVE-2026-28134
|
JetEngine [jet-engine] < 3.8.1.2 |
Control incorrecto de la generación de código (inyección de código) |
Alta
8,5
|
< 3.8.1.2
|
3.8.1.2 |
2026-02-26 |
—
|
|
CVE-2026-32355
|
JetEngine [jet-engine] < 3.8.4.1 |
Deserialización de datos no confiables |
Alta
8,8
|
< 3.8.4.1
|
3.8.4.1 |
2026-02-14 |
—
|
|
CVE-2025-68495
|
JetEngine [jet-engine] < 3.8.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Alta
7,1
|
< 3.8.1
|
3.8.1 |
2026-02-11 |
—
|
|
CVE-2025-67923
|
JetEngine [jet-engine] < 3.7.8 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Alta
7,1
|
< 3.7.8
|
3.7.8 |
2026-01-05 |
—
|
|
CVE-2025-69333
|
JetEngine [jet-engine] < 3.8.1.2 |
Falta de control de autorización |
Desconocido
|
< 3.8.1.2
|
3.8.1.2 |
2025-12-30 |
—
|
|
CVE-2025-49938
|
JetEngine [jet-engine] < 3.7.4 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 3.7.4
|
3.7.4 |
2025-09-18 |
—
|
|
CVE-2025-54688
|
JetEngine [jet-engine] < 3.7.2 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 3.7.2
|
3.7.2 |
2025-07-30 |
—
|
|
CVE-2025-53196
|
JetEngine [jet-engine] < 3.7.1.1 |
Inserción de información sensible en los datos enviados |
Media
6,5
|
< 3.7.1.1
|
3.7.1.1 |
2025-07-16 |
—
|
|
CVE-2025-53194
|
JetEngine [jet-engine] < 3.7.1.1 |
Neutralización incorrecta de scripts en atributos de etiquetas IMG en una página web |
Alta
8,5
|
< 3.7.1.1
|
3.7.1.1 |
2025-07-13 |
—
|
|
CVE-2025-53195
|
JetEngine [jet-engine] < 3.7.1.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 3.7.1.1
|
3.7.1.1 |
2025-06-27 |
—
|
|
CVE-2025-26870
|
JetEngine [jet-engine] < 3.6.5 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 3.6.5
|
3.6.5 |
2025-04-11 |
—
|
|
CVE-2023-48762
|
JetEngine [jet-engine] < 3.2.5.2 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
6,3
|
< 3.2.5.2
|
3.2.5.2 |
2023-11-28 |
—
|
|
CVE-2023-48761
|
JetEngine [jet-engine] < 3.2.5.2 |
Falta de control de autorización |
Media
6,3
|
< 3.2.5.2
|
3.2.5.2 |
2023-11-28 |
—
|
|
CVE-2023-48758
|
JetEngine [jet-engine] < 3.2.5 |
Falta de control de autorización |
Alta
7,1
|
< 3.2.5
|
3.2.5 |
2023-11-28 |
—
|
|
CVE-2023-48757
|
JetEngine [jet-engine] < 3.2.5 |
Gestión incorrecta de privilegios |
Alta
8,8
|
< 3.2.5
|
3.2.5 |
2023-11-28 |
—
|
|
CVE-2023-1406
|
JetEngine [jet-engine] < 3.1.3.1 |
Carga de archivos sin restricción de tipo peligroso |
Alta
8,8
|
< 3.1.3.1
|
3.1.3.1 |
2023-03-20 |
—
|
|
CVE-2025-0369
|
JetEngine [jet-engine] < 3.6.3 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,4
|
< 3.6.3
|
3.6.3 |
0000-00-00 |
—
|
|
CVE-2026-4662
|
JetEngine [jet-engine] < 3.8.6.2 |
— |
Desconocido
|
< 3.8.6.2
|
3.8.6.2 |
0000-00-00 |
—
|
|
CVE-2026-4352
|
JetEngine [jet-engine] < 3.8.6.2 |
— |
Desconocido
|
< 3.8.6.2
|
3.8.6.2 |
0000-00-00 |
—
|
CVE-2026-49076
The JetEngine plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.8.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-49084
The JetEngine plugin for WordPress is vulnerable to SQL Injection in versions up to 3.8.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-42774
The JetEngine plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.8.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-28134
The JetEngine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-32355
The JetEngine plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.8.4.1 (exclusive) via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-68495
The JetEngine plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-67923
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-69333
The JetEngine plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.8.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-49938
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-54688
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-53196
The JetEngine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-53194
The JetEngine plugin for WordPress is vulnerable to Remote Code Execution via SSTI in all versions up to, and including, 3.7.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-53195
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-26870
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-48762
Multiple plugins by Crocoblock for WordPress are vulnerable to Cross-Site Request Forgery in various versions. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-48761
Update the WordPress JetEngine plugin to the latest available version (at least 3.2.5.2).
Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress JetEngine Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.2.5.2.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-48758
Update the WordPress JetEngine plugin to the latest available version (at least 3.2.5).
Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress JetEngine Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.2.5.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-48757
Update the WordPress JetEngine plugin to the latest available version (at least 3.2.5).
Rafie Muhammad (Patchstack) discovered and reported this Privilege Escalation vulnerability in WordPress JetEngine Plugin. This could allow a malicious actor to escalate their low privileged account to something with higher privileges. After this they could take full control of the website if high privileges are gained. This vulnerability has been fixed in version 3.2.5.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-1406
Update the WordPress JetEngine plugin to the latest available version (at least 3.1.3.1).
R3zk0n discovered and reported this Remote Code Execution (RCE) vulnerability in WordPress JetEngine Plugin. This could allow a malicious actor to execute commands on the target website. This can be used to gain backdoor access to then take full control of the website. This vulnerability has been fixed in version 3.1.3.1.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2025-0369
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘list_tag’ parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-4662
The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This is due to the `filtered_query` parameter being excluded from the HMAC signature validation (allowing attacker-controlled input to bypass security checks) combined with the `prepare_where_clause()` method in the SQL Query Builder not sanitizing the `compare` operator before concatenating it into SQL statements. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, provided the site has a JetEngine Listing Grid with Load More enabled that uses a SQL Query Builder query.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-4352
The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into a SQL query string via `sprintf()` without sanitization or use of `$wpdb->prepare()`. WordPress REST API's `wp_unslash()` call on `$_GET` strips the `wp_magic_quotes()` protection, allowing single-quote-based injection. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The Custom Content Types module must be enabled with at least one CCT configured with a public REST GET endpoint for exploitation.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.