CVE-2025-0369 Overview
The JetEngine plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the list_tag parameter. The flaw affects all versions up to and including 3.6.2. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who visits an affected page, including administrators. This vulnerability is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in visitors' browsers, enabling session theft, account takeover, and administrative privilege escalation.
Affected Products
- Crocoblock JetEngine plugin for WordPress, versions up to and including 3.6.2
- WordPress sites with Contributor-level or higher user registration enabled
- Any WordPress site rendering JetEngine listing widgets built with attacker-controlled list_tag values
Discovery Timeline
- 2025-01-18 - CVE-2025-0369 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0369
Vulnerability Analysis
JetEngine is a Crocoblock plugin that lets WordPress editors build dynamic listings, custom post types, and content grids. The listing grid widget accepts a list_tag parameter that controls the HTML wrapper element rendered around list items. The plugin fails to sanitize this parameter on input and does not escape it during output rendering.
An authenticated attacker with Contributor-level access can supply a crafted list_tag value containing HTML attributes or script payloads. When WordPress renders the listing, the payload is embedded directly into the page markup. The stored payload persists across sessions and executes for every user who loads the affected page.
Because administrators frequently review Contributor submissions, the payload commonly executes in the admin context. This enables session cookie theft, forced administrative actions via CSRF, and creation of persistent backdoors.
Root Cause
The root cause is a missing sanitization layer on the list_tag request parameter combined with unescaped output. Neither sanitize_key(), wp_kses(), nor esc_attr() is applied before the value is inserted into the rendered HTML tag structure.
Attack Vector
Exploitation requires authenticated access with Contributor privileges or higher and network access to the WordPress site. The attacker configures a JetEngine listing widget, submits a payload in the list_tag field, and waits for an authenticated user to view the page. Because scope is changed, the payload executes in the origin of the WordPress site regardless of the attacker's original privilege boundary.
No verified proof-of-concept code is public. See the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2025-0369
Indicators of Compromise
- Unexpected <script> tags or event-handler attributes such as onerror= or onload= embedded in JetEngine listing markup
- New or modified WordPress administrator accounts created shortly after a Contributor submitted or edited a listing
- Outbound HTTP requests from admin browser sessions to unfamiliar domains after viewing Contributor-authored pages
- JetEngine listing configurations where list_tag contains characters outside the expected tag name character set (e.g., <, >, ", =)
Detection Strategies
- Query the wp_postmeta table for JetEngine listing meta values containing angle brackets, javascript: URIs, or HTML event handlers
- Deploy web application firewall rules that inspect POST bodies for suspicious list_tag values during listing edits
- Monitor WordPress audit logs for Contributor accounts editing or creating JetEngine listings
Monitoring Recommendations
- Enable a WordPress activity log plugin to record user role changes, plugin edits, and listing modifications
- Alert on any script execution or DOM modification originating from JetEngine-rendered elements using browser telemetry or a Content Security Policy report endpoint
- Correlate admin console access logs with recent Contributor content submissions to identify potential XSS triggering events
How to Mitigate CVE-2025-0369
Immediate Actions Required
- Update the JetEngine plugin to a version later than 3.6.2 immediately via the WordPress plugin dashboard
- Audit existing JetEngine listings for suspicious list_tag values and remove any containing HTML or script content
- Review Contributor and Author accounts, disabling or removing any that are unrecognized or inactive
- Rotate administrator session cookies and passwords if suspicious listing content is discovered
Patch Information
Crocoblock addressed the vulnerability in a JetEngine release following version 3.6.2. Refer to the Crocoblock Changelog for the exact fixed version and release notes. The vendor plugin page is available at Crocoblock JetEngine Plugin.
Workarounds
- Restrict Contributor and Author role assignment to trusted users only until the plugin is patched
- Disable JetEngine listing editing capabilities for lower-privileged roles via a WordPress capability management plugin
- Deploy a Content Security Policy header that blocks inline script execution to reduce XSS impact
- Enable a web application firewall with rules that filter HTML metacharacters from list_tag request parameters
# Configuration example: enforce Content Security Policy in Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
