The JetEngine WordPress plugin versions prior to 3.8.12 contain a stored XSS vulnerability (CWE-79) due to improper escaping of post meta values in shortcode output. This allows users with Contributor role or above to inject malicious scripts that execute with the privileges of higher-level users, including administrators. No CVSS score or official remediation details are provided in the available data.

Successful exploitation enables stored Cross-Site Scripting attacks that execute malicious scripts in the browser context of higher-privileged users, potentially leading to session hijacking, privilege escalation, or unauthorized actions within the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor and higher roles from untrusted users or avoid using vulnerable shortcodes that output post meta values. Monitor vendor channels for updates regarding patches or official mitigations.