CVE-2026-14864 Overview
CVE-2026-14864 is a Stored Cross-Site Scripting (XSS) vulnerability in the JetEngine WordPress plugin prior to version 3.8.12. The plugin fails to escape a post meta value before rendering it through one of its shortcodes. Authenticated users holding the Contributor role or above can inject persistent JavaScript payloads that execute in the browsers of higher-privileged users, including administrators. Successful exploitation enables session theft, forced administrative actions, and pivoting into further site compromise. The flaw maps to CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
A Contributor-level account can store malicious script in post meta and execute code in an administrator's browser session, enabling privilege escalation on affected WordPress sites.
Affected Products
- JetEngine WordPress plugin versions prior to 3.8.12
- WordPress installations using vulnerable JetEngine shortcodes to render post meta
- Multi-author WordPress sites where Contributor accounts can create draft content
Discovery Timeline
- 2026-08-02 - CVE-2026-14864 published to the National Vulnerability Database
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-14864
Vulnerability Analysis
JetEngine is a WordPress plugin used to build dynamic content, custom post types, and meta fields. The vulnerability exists because one of the plugin's shortcodes outputs a post meta value directly into the rendered page without applying an appropriate escaping function such as esc_html() or esc_attr(). When a Contributor stores a crafted meta value on a post, any later page render that includes the affected shortcode executes the attacker-supplied JavaScript in the visitor's browser. Because administrators routinely preview and moderate contributor submissions, the payload frequently triggers under an administrator session. This is a Stored XSS with a scope change, allowing script from a lower-privileged input surface to affect a higher-privileged authenticated context.
Root Cause
The root cause is missing output encoding. The JetEngine shortcode handler retrieves the post meta value through WordPress meta APIs and injects it into HTML without contextual escaping. WordPress meta values are stored as-is and must be escaped at the point of output, which the vulnerable shortcode omits.
Attack Vector
The attack requires an authenticated user with at least the Contributor role. The attacker creates or edits a post and populates a meta field consumed by a JetEngine shortcode with an XSS payload such as an <img> tag with an onerror handler or an inline <script> block. When an administrator opens the post preview, moderation queue, or any front-end page that renders the affected shortcode, the payload executes with the administrator's privileges and cookies.
No verified public proof-of-concept code is available. Refer to the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-14864
Indicators of Compromise
- Post meta entries containing HTML tags such as <script>, <img onerror=, <svg onload=, or event-handler attributes stored by non-administrator authors
- Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after previewing contributor content
- New administrator accounts, altered user roles, or plugin installations that correlate with a Contributor's recent post activity
Detection Strategies
- Audit the wp_postmeta table for meta values containing HTML or JavaScript syntax, filtered by posts authored by Contributor-level users
- Enable WordPress activity logging to correlate post edits by low-privileged users with subsequent administrator sessions that rendered those posts
- Review web server access logs for suspicious admin-ajax.php or wp-admin requests originating from administrator sessions immediately after previewing contributor drafts
Monitoring Recommendations
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions on WordPress admin and preview pages
- Monitor JetEngine plugin version across all managed WordPress instances and alert when versions below 3.8.12 are detected
- Track role changes, plugin installations, and option modifications performed under administrator accounts for anomalous patterns
How to Mitigate CVE-2026-14864
Immediate Actions Required
- Upgrade the JetEngine plugin to version 3.8.12 or later on every WordPress site where it is installed
- Audit existing Contributor, Author, and Editor accounts and remove any that are inactive or unrecognized
- Inspect post meta values authored by non-administrator users and remove entries containing HTML or JavaScript payloads
Patch Information
The vendor addressed the issue in JetEngine version 3.8.12 by applying proper output escaping to the affected shortcode. Details are documented in the WPScan Vulnerability Report. Site operators should verify the installed version through the WordPress plugin management screen after updating.
Workarounds
- Temporarily restrict Contributor and Author role assignments until the plugin is patched
- Disable the affected JetEngine shortcode on public and preview templates if immediate patching is not feasible
- Enforce a strict Content Security Policy that blocks inline scripts and unauthorized script sources in the WordPress admin interface
# Update JetEngine via WP-CLI on all managed WordPress instances
wp plugin update jet-engine --version=3.8.12
wp plugin get jet-engine --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
