CVE-2026-97238 is a CWE-79 Cross-Site Scripting vulnerability in JetEngine versions up to 3.8.14.3. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of subscriber users. The CVSS 3.1 base score is 5.5, reflecting network attack vector, high attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability at a low level. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a subscriber user, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires user interaction and low privileges, with high complexity, limiting the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting exposure of affected versions and applying any recommended workarounds from the vendor if published.