The CVSS 6.1 score for CVE-2026-17019 dramatically understates the risk because it treats this as a routine stored XSS — but it isn't. The vulnerability grants unauthenticated users the ability to upload SVG files containing malicious payloads directly into your media library. Most SVG XSS bugs in WordPress plugins require an attacker to have at least subscriber-level credentials; this one accepts uploads from anyone with network access. That single fact transforms the severity calculation entirely.
When a stored XSS payload lands in a location an administrator accesses — and the WordPress media library is accessed by admins viewing uploads or using the post editor — the impact isn't session hijacking. It's site compromise. Administrator accounts in WordPress typically hold the install_plugins capability, which permits arbitrary plugin installation and PHP execution. An attacker who injects JavaScript that fires when an admin views the uploaded SVG has a direct path to remote code execution, not a theoretical escalation. This is documented, common attack chaining in WordPress environments, and the CVSS model doesn't account for it.
Your action priorities: First, confirm whether JetEngine's upload endpoint is exposed to unauthenticated requests — check your access logs for POST requests to /wp-content/uploads/jet-engine/ or similar paths originating from IP addresses outside your authentication proxy. Second, audit existing SVG files in your upload directories. The patch sanitizes future uploads; it does not remove malicious files already on disk. Examine all SVG files in /wp-content/uploads/ for script tags, event handlers (on* attributes), <use>, <foreignObject>, and javascript: URIs in link targets. If your site was running an unpatched version of JetEngine, treat any SVG uploaded during that window as potentially compromised. Third, verify your patch level — ensure JetEngine is at 3.8.13.1 or later, but recognize that sanitization-only fixes for SVG have a history of incomplete coverage. Monitor for recurrence.