CVE-2026-18202

The JetEngine WordPress plugin, prior to version 3.8.14, incorrectly allows users with the ability to upload files to add malicious SVG files to the list of permitted upload types without properly filtering their contents. This vulnerability enables an attacker to upload a specially crafted SVG file containing malicious JavaScript code, which can then be executed in the browser of any user who opens it, potentially leading to a stored cross-site scripting (XSS) attack. In a multisite environment, this flaw also bypasses upload-type restrictions set by the network administrator.

Based on public CVE data (MITRE/NVD).