CVE-2025-0369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0369", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-09T22:28:04.320Z", "datePublished": "2025-01-18T07:05:10.395Z", "dateUpdated": "2026-04-08T17:32:38.460Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:38.460Z"}, "affected": [{"vendor": "Crocoblock", "product": "JetEngine", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018list_tag\u2019 parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f27979a8-0e68-4a45-9e3e-3667d88361d8?source=cve"}, {"url": "https://crocoblock.com/plugins/jetengine/"}, {"url": "https://crocoblock.com/changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "timeline": [{"time": "2025-01-17T18:34:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-21T21:20:49.526116Z", "id": "CVE-2025-0369", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-21T21:20:53.014Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0369", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-21T21:20:49.526116Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-21T21:20:37.593Z"}}], "cna": {"title": "Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "Crocoblock", "product": "JetEngine", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-17T18:34:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f27979a8-0e68-4a45-9e3e-3667d88361d8?source=cve"}, {"url": "https://crocoblock.com/plugins/jetengine/"}, {"url": "https://crocoblock.com/changelog/"}], "descriptions": [{"lang": "en", "value": "The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018list_tag\u2019 parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:38.460Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0369", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:38.460Z", "dateReserved": "2025-01-09T22:28:04.320Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-01-18T07:05:10.395Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "JetEngine", "vendor": "Crocoblock", "versions": [{"lessThanOrEqual": "3.6.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018list_tag\u2019 parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento JetEngine para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro \u2018list_tag\u2019 en todas las versiones hasta la 3.6.2 y incluida, debido a un escape de entrada y salida insuficiente de desinfecci\u00f3n. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten Scripts web arbitraria en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-0369", "lastModified": "2026-06-17T08:26:21.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0369", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-21T21:20:49.526116Z", "version": "2.0.3"}}]}, "published": "2025-01-18T07:15:09.720", "references": [{"source": "security@wordfence.com", "url": "https://crocoblock.com/changelog/"}, {"source": "security@wordfence.com", "url": "https://crocoblock.com/plugins/jetengine/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f27979a8-0e68-4a45-9e3e-3667d88361d8?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:28:50.125917+00:00", "value": {"mitigation_remediation": ["Update the JetEngine plugin to version 3.6.3 or later to remove the underlying input validation and output escaping issue.", "If an upgrade is not immediately possible, restrict Contributor or higher level access for users, or disable the list_tag functionality via custom code or a complementary security plugin.", "Verify that the list_tag parameter is no longer writable by an authenticated attacker by inspecting the plugin\u2019s settings page or database entries for unexpected values."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Crocoblock\u2019s JetEngine plugin for WordPress in all releases up to and including version 3.6.2 is affected. Any site that has installed one of these vulnerable versions is at risk. The vulnerability remains in all prior releases of the plugin; upgrading to a later version completely removes the flaw.", "description_and_impact": "The JetEngine plugin for WordPress suffers from a stored cross\u2011site scripting flaw that can be triggered through the list_tag parameter. The flaw stems from insufficient input sanitization and output escaping, allowing authenticated users with Contributor\u2011level access or higher to embed arbitrary web scripts. When a victim accesses a page containing the injected value, the malicious script executes in the victim\u2019s browser, potentially leading to session hijacking, credential theft, defacement, or phishing attacks. This vulnerability grants attackers a persistent control over the user\u2019s viewing context but does not provide remote code execution on the server side.", "risk_and_exploitability": "The official CVSS score is 6.4, placing the issue in the medium severity range. The EPSS score of less than 1% indicates that exploitation attempts are relatively unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to possess Contributor or higher credentials, which may be available through legitimate user roles. Once authenticated, the attacker submits a crafted value for the list_tag field, which then persists in the database and is rendered on the front\u2011end when the corresponding page is viewed. The impact is limited to browsers of authenticated or unfiltered users who view the injected content, but the attacker can leverage this to conduct session\u2011level attacks against those users."}}}}, "created": "2025-07-12T15:26:29.282921+00:00", "updated": "2026-04-21T22:30:06.138997+00:00", "vendors": ["crocoblock", "crocoblock$PRODUCT$jetengine", "wordpress", "wordpress$PRODUCT$wordpress"]}