Vulnerabilities

TI-2026-39093 CVE-2026-54189 · GHSA-mrx8-c587-75qg

WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00142 Published 2026-06-17 No fix listed CWE-79

TI-2026-39092 CVE-2026-54188 · GHSA-jcgw-c44x-p34m

WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00142 Published 2026-06-17 No fix listed CWE-79

TI-2026-39091 CVE-2026-54187 · GHSA-r365-mxm3-c49c

WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00283 Published 2026-06-17 No fix listed CWE-89

TI-2026-37831 CVE-2026-52706 · GHSA-qw4p-9prr-vcv7

WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability

MEDIUM 49

Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00466 Published 2026-06-17 No fix listed CWE-502

TI-2026-37821 CVE-2026-52696 · GHSA-qh8c-5j7c-5qv9

WordPress JetBlog plugin <= 2.4.8 - Sensitive Data Exposure vulnerability

LOW 38

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00238 Published 2026-06-17 No fix listed CWE-1258

TI-2026-36310 CVE-2026-49084 · GHSA-65wx-2g95-vf3v

WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00283 Published 2026-06-17 Fixed in 3.8.9.1 CWE-89

TI-2026-36305 CVE-2026-49079 · GHSA-rm7h-637q-mh3m

WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00346 Published 2026-06-17 No fix listed CWE-89

TI-2026-36301 CVE-2026-49075 · GHSA-jch3-56hc-53q6

WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability

MEDIUM 49

Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00375 Published 2026-06-17 No fix listed CWE-502

TI-2026-36300 CVE-2026-49074 · GHSA-pvg6-vrjq-jpp8

WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-06-17 No fix listed CWE-79

TI-2026-36139 CVE-2026-48875 · GHSA-97hc-qqx6-76wc

WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00423 Published 2026-06-17 No fix listed CWE-89

TI-2023-04808 CVE-2023-5230 · GHSA-4jr2-62qw-fhx8

TM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 29

The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to, and including, 1.1.7 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00378 Published 2023-09-28 No fix listed CWE-79