The JetEngine WordPress plugin prior to version 3.8.14 improperly allows SVG file uploads without sanitizing the file content. This permits users with upload files capability, such as Authors, to upload SVG files containing malicious JavaScript. When these files are viewed, the embedded script executes in the context of the victim's browser, constituting a stored cross-site scripting (CWE-79) vulnerability. Additionally, in multisite environments, this behavior overrides network administrator upload-type restrictions.

An attacker with upload permissions can upload malicious SVG files that execute arbitrary JavaScript in the browsers of users who view them. This can lead to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). On multisite setups, it also circumvents network-level upload restrictions, increasing the attack surface.

Upgrade the JetEngine plugin to version 3.8.14 or later where this vulnerability is fixed. Since a patch is available in version 3.8.14, applying this official fix is the recommended remediation. Until upgraded, restrict upload permissions to trusted users only and consider disabling SVG uploads if possible.