CVE-2026-97265

Executive Summary

CVE-2026-97265 is a stored cross-site scripting (XSS) vulnerability in JetEngine, a dynamic content and custom post-type plugin for WordPress maintained by Crocoblock (Jetimpex Inc.), affecting all versions through 3.8.15.3. The flaw resides in the improper neutralization of user-supplied input during web page generation (CWE-79), allowing an authenticated attacker with low privileges to persist arbitrary script into content that is later rendered to other users. Successful exploitation enables session hijacking, credential theft, and privileged actions performed in the context of an administrator's authenticated browser session, with a CVSS v3.1 base score of 6.5 (Medium).

Technical Analysis

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly referred to as Cross-site Scripting. NVD describes the specific subtype as Stored XSS, meaning the malicious input is persisted server-side and subsequently served to one or more victims rather than reflected in a single immediate response.

JetEngine is a WordPress plugin that provides functionality for building dynamic templates, custom post types, taxonomies, listings, and dynamic content blocks. Any feature that accepts and later re-displays user-controlled data represents a potential sink for stored XSS. Because the plugin's core purpose is rendering database-sourced content into page output, it inherently creates a large surface area where input encoding and output escaping must be applied consistently.

At the code level, a stored XSS flaw of this class occurs when user input is written to persistent storage (e.g., post meta, custom fields, taxonomy terms, or plugin-specific option records) and later emitted into HTML without contextual output encoding. The vulnerability is triggered whenever a page or template that references that stored value is rendered. Notably, NVD assigns the attack vector as network (AV:N), attack complexity as low (AC:L), and privileges required as low (PR:L), which indicates the attacker must hold an authenticated account on the target WordPress instance but need not possess administrative rights. The CVSS scope field is set to Changed (S:C), meaning exploitation can affect resources beyond the vulnerable component's original authorization scope — consistent with an attacker-controlled script executing in the security context of a higher-privileged victim's browser.

No CNA title, vendor advisory, file path, function name, or parameter identifier was provided in the source intelligence. Consequently, no specific vulnerable function, hook, REST route, AJAX action, shortcode, or database column can be named without fabricating details. The mechanism described above is derived strictly from the vulnerability class and the impact profile indicated by the CVSS vector.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE, and no exploitation activity has been observed in the wild. The attack chain below is inferred at the vulnerability-class level from the NVD description and CVSS metrics. No specific parameter names, endpoints, or code patterns are asserted because none are documented in the source data.

1. Reconnaissance and target identification. The attacker identifies WordPress installations running JetEngine at a vulnerable version (through 3.8.15.3). This is achievable through public fingerprinting of plugin assets, generator metadata, or HTTP response characteristics. Shodan and similar engines can be leveraged with the dorks listed in the metadata to locate exposed instances.

2. Privilege acquisition. Because the CVSS vector specifies PR:L, the attacker must hold at least a low-privileged authenticated account (for example, a subscriber or contributor-style role, depending on the site's configuration). This can be obtained through self-registration, credential stuffing, or prior compromise of a low-value account. No privilege escalation is required to trigger the flaw.

3. Injection of persistent payload. Once authenticated, the attacker supplies input through a plugin feature that stores user-controlled data and later renders it on a page. The input contains HTML/JavaScript that is not neutralized on ingestion. Because the vulnerability is Stored XSS, the payload is written to the database and remains resident.

4. Delivery to the victim. When a higher-privileged user (such as an administrator or editor) views the affected page, template, listing, or administrative view that renders the stored value, the injected script executes in that victim's browser context. The UI:R (user interaction required) metric reflects the need for a victim to access the tainted output.

5. Post-exploitation impact. With script executing under the victim's session, an attacker can exfiltrate session cookies, perform authenticated actions as the victim, inject further malicious content, create rogue administrative accounts, modify site content, or pivot toward full site takeover. The Changed scope (S:C) captures this expansion of impact beyond the originally vulnerable component.

Defenders should treat any low-privileged input path in JetEngine that is subsequently displayed to other users as an in-scope trigger until a fixed version is published.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium), composed of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.

• Confidentiality (Low): Script execution in a victim's browser can expose session tokens, cookies, and data accessible to that session.
• Integrity (Low): The attacker can alter content or state as the victim, including persistent modification of stored records.
• Availability (Low): Limited availability impact, consistent with the ability to disrupt or deface rendered content.
• Scope (Changed): The most significant scoring element — exploitation can affect parties and resources outside the vulnerable plugin component, specifically administrator sessions.

Blast radius. Any WordPress site running JetEngine <= 3.8.15.3 that permits low-privileged user input and exposes it to higher-privileged viewers is at risk. In multisite deployments or managed WordPress hosting environments, a single compromised administrative session could enable lateral movement across sites sharing credentials or infrastructure. Sites configured to auto-publish user-generated content to public-facing templates experience a larger victim pool, as more viewers (including administrators browsing the live site) will render the injected payload.

Business impact. Stored XSS in a CMS plugin frequently serves as a stepping stone to full site compromise. Consequences include unauthorized content injection, SEO poisoning, malvertising, theft of administrative credentials, and, in severe cases, persistent backdoor installation. Because JetEngine is a widely deployed builder plugin, the aggregate exposure across the WordPress ecosystem is significant even at a Medium severity rating.

Detection Guidance

Sigma Rule

title: JetEngine Stored XSS Attempt - Suspicious Script Content in Plugin Input
id: 3f9c2a14-77b1-4e0d-9c21-2026cve97265
status: experimental
description: Detects submission of HTML/JavaScript payloads (e.g. script tags, event handlers, javascript URIs) to WordPress endpoints likely associated with JetEngine dynamic content, indicative of stored XSS injection attempts against CVE-2026-97265.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97265
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1059.007
  - cve.2026.97265
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method: 'POST'
  selection_payload:
    - cs-uri-query|contains:
        - 'jet-engine'
        - 'jetengine'
  selection_suspicious:
    - cs-uri-query|contains:
        - '%3Cscript'
        - 'onerror='
        - 'onload='
        - 'javascript:'
        - 'document.cookie'
        - '<img'
  condition: selection_method and (selection_payload) and selection_suspicious
falsepositives:
  - Legitimate authors embedding allowed HTML in trusted roles
  - Security scanners performing benign assessments
level: medium

YARA Rule

rule CVE_2026_97265_JetEngine_Stored_XSS_Payload
{
    meta:
        description = "Detects stored XSS payload artifacts associated with CVE-2026-97265 in JetEngine content/inputs"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97265"
        cve = "CVE-2026-97265"

    strings:
        $h1 = "<script" ascii nocase
        $h2 = "</script>" ascii nocase
        $e1 = "onerror=" ascii nocase
        $e2 = "onload=" ascii nocase
        $e3 = "onmouseover=" ascii nocase
        $j1 = "javascript:" ascii nocase
        $c1 = "document.cookie" ascii nocase
        $c2 = "XMLHttpRequest" ascii nocase
        $i1 = "<iframe" ascii nocase
        $i2 = "<img" ascii nocase

    condition:
        uint16(0) == 0x3C3F or
        (2 of ($h*) or
         any of ($e*) or
         $j1 or
         any of ($c*) or
         any of ($i*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97265 JetEngine Stored XSS Injection Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"jet-engine"; nocase; http.client_body; content:"<script"; nocase; http.client_body; content:"document.cookie"; nocase; reference:cve,2026-97265; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97265; classtype:web-application-attack; sid:202697265; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      http.request.body.content : ("<script" or "onerror=" or "onload=" or "javascript:") and
      http.request.body.content : ("jet-engine" or "jetengine") ]
  [ network where http.response.status_code == 200 and
      http.request.body.content : ("<script" or "javascript:") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval post_body = coalesce(urldecode(form_data), urldecode(uri_query), "")
| where match(lower(post_body), "<script|onerror=|onload=|javascript:|document\.cookie|%3cscript")
| where match(lower(uri), "jet.?engine|admin-ajax|wp-json|xmlrpc")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(clientip) as src_ips by host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-97265,">
  <rule id="100265" level="10">
    <if_sid>31100</if_sid>
    <id>^POST</id>
    <match>jet-engine|jetengine</match>
    <regex>(\?|&amp;|%3C)script|onerror=|onload=|javascript:|document\.cookie</regex>
    <description>CVE-2026-97265: Possible JetEngine stored XSS injection attempt detected</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_97265,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected-version list, or workaround has been published by any tracked source. Version 3.8.15.3 is the last known-affected release.

1) Immediate mitigations

• Enforce strict role separation: audit which roles can submit content that is rendered to other users, and remove untrusted roles from any JetEngine input path that displays to administrators.
• Enable a WordPress web application firewall (WAF) with rules targeting stored XSS patterns (<script, event handlers, javascript: URIs) on request bodies directed at plugin endpoints and admin-ajax.php.
• Apply WordPress core capability hardening: restrict self-registration, disable unfiltered HTML for non-admin roles, and review any capability grant that permits low-privileged users to publish or store markup.
• Conduct content review of recently stored dynamic content for injected markup; sanitize or remove suspicious records.
• Deploy the provided detection rules (Sigma, Suricata, Wazuh, Elastic, Splunk) to monitor for injection attempts.

2) Patch/upgrade steps

• No fixed version currently exists from the vendor. Monitor the Crocoblock and Jetimpex advisories as well as the NVD CVE record for the first patched release.
• Once a fixed version is published, test in staging and upgrade JetEngine promptly. As a stopgap, evaluate plugin deactivation if the business risk of continued operation outweighs functional dependency.

3) Long-term hardening

• Maintain a WordPress plugin inventory with automated CVE monitoring so vulnerable versions are flagged quickly.
• Enforce contextual output encoding across custom development and adopt Content Security Policy (CSP) headers to reduce script execution impact.
• Apply the principle of least privilege to all CMS roles and require strong, unique administrator credentials with MFA.
• Establish a patch SLAs tier for internet-facing CMS components and integrate OSV/NVD feeds into your vulnerability management pipeline.

References

• NVD — CVE-2026-97265: https://nvd.nist.gov/vuln/detail/CVE-2026-97265
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• Crocoblock / Jetimpex Inc. JetEngine product page (vendor advisory monitored for patch): https://crocoblock.com/plugins/jetengine/
• FIRST EPSS — no score currently assigned for this CVE (https://www.first.org/epss/)

No exploited-in-the-wild activity, threat actor campaign, CISA KEV listing, public PoC, exploit code, or Nuclei template has been identified for CVE-2026-97265 at the time of writing.