First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-49074

HighCVSS 7.1/10Last modified Oct 26, 2026

Description

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
Jetimpex Inc.	JetEngine	<= 3.8.9.1

References

https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve

Timeline

Published: Jun 17, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-490759.8Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.CVE-2026-490769.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows CVE-2026-490775.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Em CVE-2026-490787.5Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.CVE-2026-490799.3Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.CVE-2026-49089.8A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /modstaffinfo.p CVE-2026-490809.3Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.CVE-2026-490818.2Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.CVE-2026-490827.4Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat CVE-2026-490837.5Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.CVE-2026-490849.3Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.CVE-2026-490859.8Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

CVE-2026-49074: High severity, CVSS 7.1 | Vulnix