Input validation vulnerability in JetEngine 3.6.2

The JetEngine plugin for WordPress has a security issue where a type of malicious code, known as Stored Cross-Site Scripting, can be inserted through a specific part of the plugin called the ‘list_tag’ parameter. This can happen in any version of the plugin up to version 3.6.2. The problem is caused by not properly filtering and protecting the input and output of the plugin. This means that someone with authorized access, at the Contributor level or higher, can add harmful code to pages that will be activated whenever a user visits the affected page.