CVE Database /
CVE-2025-54688
CVE · Medium
CVE-2025-54688 — JetEngine [jet-engine] < 3.7.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-54688
|
JetEngine [jet-engine] < 3.7.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.5
|
< 3.7.2
|
3.7.2 |
2025-07-30 |
—
|
CVE-2025-54688
The JetEngine plugin for WordPress contains a security flaw in versions 3.7.1.2 and earlier, allowing malicious users with at least contributor privileges to embed executable code into certain webpage content. This occurs due to inadequate filtering of input data and insufficient protection against script injection. As a result, when an affected page is visited by another user, the injected code will be executed.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings