CVE-2026-11380
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk5th percentile — higher than 5% of all known CVEs
Summary
The JetWidgets For Elementor plugin for WordPress up to version 1.0.21 is vulnerable to Stored Cross-Site Scripting (XSS). This is due to insufficient output escaping and missing server-side validation of the Animated Box widget's animation_effect setting before it is rendered inside an HTML class attribute. Authenticated attackers with author-level access or higher can inject arbitrary web scripts that execute when a user visits an injected page.
Risk Assessment
The organization is at risk of session hijacking, account takeover, and malware distribution through script execution in browsers of users visiting compromised pages.
Recommendation
Immediately update the JetWidgets For Elementor plugin to the latest available version that fixes this vulnerability. If an update is not possible, temporarily disable the Animated Box widget or restrict author-level permissions.
Original NVD description (English source)
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due to insufficient output escaping and missing server-side validation of the Animated Box widget's animation_effect setting before it is rendered inside an HTML class attribute. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.