PLUGIN SECURITY
Is Jet Engine safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Jet Engine WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
jet-engine - Requires PHP: 5.3.0+
Known vulnerabilities
- CVE-2023-1406 — JetEngine [jet-engine] < 3.1.3.1 (Unrestricted File Upload) · High
- CVE-2023-48762 — JetEngine [jet-engine] < 3.2.5.2 (CSRF) · Medium
- CVE-2023-48761 — JetEngine [jet-engine] < 3.2.5.2 (Missing Authorization) · Medium
- CVE-2023-48758 — JetEngine [jet-engine] < 3.2.5 (Missing Authorization) · High
- CVE-2023-48757 — JetEngine [jet-engine] < 3.2.5 (Privilege Escalation) · High
+ 25 more known vulnerabilities
- CVE-2025-0369 — JetEngine [jet-engine] < 3.6.3 (XSS) · Medium
- CVE-2025-26870 — JetEngine [jet-engine] < 3.6.5 (XSS) · Medium
- CVE-2025-53195 — JetEngine [jet-engine] < 3.7.1.1 (XSS) · Medium
- CVE-2025-53196 — JetEngine [jet-engine] < 3.7.1.1 (CWE-201) · Medium
- CVE-2025-54688 — JetEngine [jet-engine] < 3.7.2 (XSS) · Medium
- CVE-2025-53194 — JetEngine [jet-engine] < 3.7.1.1 (CWE-82) · High
- CVE-2025-49938 — JetEngine [jet-engine] < 3.7.4 (XSS) · Medium
- CVE-2025-69333 — JetEngine [jet-engine] < 3.8.1.2 (Missing Authorization)
- CVE-2025-67923 — JetEngine [jet-engine] < 3.7.8 (XSS) · High
- CVE-2025-68495 — JetEngine [jet-engine] < 3.8.1 (XSS) · High
- CVE-2026-28134 — JetEngine [jet-engine] < 3.8.1.2 (Code Injection) · High
- CVE-2026-32355 — JetEngine [jet-engine] < 3.8.4.1 (Insecure Deserialization) · High
- CVE-2026-4662 — JetEngine [jet-engine] < 3.8.6.2
- CVE-2026-4352 — JetEngine [jet-engine] < 3.8.6.2
- CVE-2026-42774 — JetEngine [jet-engine] < 3.8.8.2 (SQL Injection) · Critical
- CVE-2026-49075 — JetEngine [jet-engine] < 3.8.10 (Insecure Deserialization) · Critical
- CVE-2026-49074 — JetEngine [jet-engine] < 3.8.10 (XSS) · High
- CVE-2026-49076 — JetEngine [jet-engine] < 3.8.10 (SQL Injection) · Critical
- CVE-2026-49084 — JetEngine [jet-engine] < 3.8.9.1 (SQL Injection) · Critical
- CVE-2026-52706 — JetEngine [jet-engine] < 3.8.10.1 (Insecure Deserialization) · Critical
- CVE-2026-12360 — JetEngine [jet-engine] < 3.8.10.2 (SQL Injection) · High
- CVE-2026-54189 — JetEngine [jet-engine] < 3.8.10.1 (XSS) · High
- CVE-2026-54188 — JetEngine [jet-engine] < 3.8.10.1 (XSS) · High
- CVE-2026-54187 — JetEngine [jet-engine] < 3.8.10.2 (SQL Injection) · Critical
- CVE-2026-56068 — JetEngine [jet-engine] < 3.8.11 (SQL Injection) · Critical
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- Google Authenticator — 20000+ active installs — max PHP 8.4
- User Verification by PickPlugins — 5000+ active installs
- Double Opt-In for Contact Form 7 – Secure, GDPR-Compliant Email Verification — 1000+ active installs — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.