The JetEngine WordPress plugin versions prior to 3.8.14 improperly allow SVG file uploads by adding SVG to the allowed upload types without sanitizing the file contents. This flaw permits users with the capability to upload files, such as Authors, to upload SVG files containing malicious JavaScript. When such a file is accessed, the embedded script executes in the browser of any user viewing it, constituting a stored cross-site scripting (CWE-79) vulnerability. Additionally, on multisite WordPress setups, this vulnerability overrides network administrator restrictions on upload types, expanding the attack surface.

An attacker with upload permissions can upload a malicious SVG file containing JavaScript that executes in the context of users' browsers who open the file. This can lead to session hijacking, defacement, or other client-side attacks. On multisite environments, the vulnerability circumvents network-level upload restrictions, potentially increasing exposure. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict upload permissions to trusted users only and consider disabling SVG uploads if possible. Monitor vendor channels for updates and apply official patches once released.