What is GHSA-g5mm-h736-h3g3?

GHSA-g5mm-h736-h3g3 is a security advisory published by GitHub Security Advisories with Medium severity. The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before...

Which CVE IDs does GHSA-g5mm-h736-h3g3 cover?

GHSA-g5mm-h736-h3g3 covers the following CVE IDs: CVE-2026-17019. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g5mm-h736-h3g3?

GHSA-g5mm-h736-h3g3 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-g5mm-h736-h3g3MediumCVSS 6.1

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before...

Vendor

GitHub Security Advisories

Published

August 10, 2026

Last Modified

August 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-17019 →

📋 Description

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-17019
https://wpscan.com/vulnerability/355ea90d-9fb3-4dc6-9676-48e5255fbc77
https://github.com/advisories/GHSA-g5mm-h736-h3g3