CVE-2026-81760

This vulnerability lets an attacker put JavaScript into a special link they send to victims. If someone clicks that link, the malicious script can run in their browser while they’re viewing your website, which can be used to redirect people, spoof pages, or perform other browser-based attacks. Think of it like a “poisoned webpage address” that tricks a visitor into executing code that your site didn’t intend.

This matters to you if you run WordPress and have the JetEngine plugin installed at version 3.8.14.2 or earlier. It does not require an attacker to log in, but it requires that a visitor is tricked into clicking a crafted link. Reachability depends on whether the vulnerable JetEngine pages are reachable and used in your normal browsing flow (exact default exposure isn’t known from the findings).

Treat this as urgent because it is an XSS issue that can execute JavaScript in a real visitor’s browser after they click a crafted link, and there is no requirement for attacker login. The recommended fix is a plugin update, so you can close the risk quickly by upgrading JetEngine.

1. Confirm exposure

   • Log into your WordPress admin area.
   • Go to the Plugins page and find “JetEngine”.
   • Verify the installed JetEngine version.
   • This CVE applies if your JetEngine version is 3.8.14.2 or earlier.

2. Upgrade to the fixed version

   • Update JetEngine to at least 3.8.14.3 (or upgrade to the latest available JetEngine release).
   • After updating, confirm the plugin version in the Plugins list.

3. Validate after the update

   • Check that your key JetEngine-powered pages still render normally.
   • If you have caching/CDN enabled, ensure caches are refreshed after the upgrade.

4. If patching is delayed (workarounds)

   • Reduce risk from click-based attacks by monitoring for suspicious inbound URLs (for example, unusual query parameters) targeting pages that use JetEngine.
   • Watch WordPress and web server logs for repeated 4xx/5xx responses or unusual spikes in requests that look like crafted-link attempts.
   • Consider temporarily restricting access to the most user-facing pages that rely on JetEngine until the update is applied.

5. What to monitor going forward

   • Reports from users/customers about unexpected redirects, popups, or “weird behavior” after visiting your site.
   • Web server logs for unusual URL patterns and elevated error rates around JetEngine pages.

Severity is HIGH (CVSS 7.1) based on network reachability, no authentication requirement, and the ability to execute scripts in a victim’s browser. The weakness is CWE-79 (Cross-Site Scripting). The mechanism is reflected XSS: user-influenced data is not safely neutralized during web page generation, so JavaScript can execute when a victim visits a crafted URL. Exploitation status: not confirmed in KEV and no public exploit code was identified in the findings; however, the core finding states that attackers can craft a malicious URL and achieve JavaScript execution via user click (user interaction is required). EPSS details are not provided in the findings. A fixed version is available: update JetEngine to at least 3.8.14.3.