The JetEngine WordPress plugin before version 3.8.12 fails to escape post meta values before rendering them via one of its shortcodes. This allows users with Contributor or higher privileges to perform stored XSS attacks, leading to script execution in the context of users with elevated privileges, including administrators. The vulnerability is identified as CWE-79 and has a CVSS v3.1 base score of 5.4, indicating a medium severity level. No official patch or remediation details are provided in the available data.

Successful exploitation enables users with Contributor role or above to execute arbitrary scripts in the browsers of higher-privileged users such as administrators. This can lead to session hijacking, privilege escalation, or other actions performed with administrator privileges within the WordPress environment. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor and higher roles from untrusted users and consider disabling or limiting the use of affected shortcodes that output post meta values. Monitor official JetEngine communications for updates and apply any released patches promptly.