CVE-2026-12360

The JetEngine plugin for WordPress contains a security flaw that allows attackers to inject malicious SQL code into the database. This vulnerability affects all versions of the plugin up to 3.8.10.1, and it occurs because the filtered_query parameter in the listing_load_more AJAX handler is not properly sanitized before being used to construct SQL queries. As a result, an attacker can exploit this weakness by manipulating meta_query values within a Load More request captured from any public Listing Grid page.

Based on public CVE data (MITRE/NVD).