The JetEngine WordPress plugin versions prior to 3.8.13.1 do not sanitize SVG file uploads before storing and serving them. Additionally, the plugin does not adequately restrict who can upload these files, enabling unauthenticated attackers to upload SVG files containing malicious JavaScript. This results in a stored cross-site scripting (CWE-79) vulnerability where the malicious script executes in the context of any user viewing the SVG, potentially compromising user data or session integrity.

An attacker can upload a malicious SVG file containing JavaScript without authentication. When other users view the SVG, the script executes in their browsers, leading to potential information disclosure and integrity loss. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity), indicating a moderate risk with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict SVG file uploads to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from the JetEngine plugin vendor and apply any official patches promptly.