CyberRota Analysis
AI-GeneratedThe JetEngine WordPress plugin prior to version 3.8.14 is vulnerable due to its allowance of SVG file uploads without proper sanitization, enabling users with upload permissions to introduce malicious JavaScript. This vulnerability can lead to Stored Cross-Site Scripting (XSS), affecting any user who interacts with the compromised content in their browser. WordPress site administrators and developers using this plugin should prioritize immediate updates to mitigate potential exploitation.
Original NVD Description
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.