CVE-2026-114707
MediumCVSS 6.5Summary
The JetElements For Elementor plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 2.9.2.5.
Risk Assessment
An attacker can store a malicious script that executes in the browsers of users visiting the site, potentially leading to session theft or account takeover. The risk applies to WordPress sites using this plugin.
Recommendation
Update JetElements For Elementor to a version later than 2.9.2.5 or apply the available workaround. Additionally, consider implementing input filtering and a Content Security Policy.
Other vulnerabilities in JetElements For Elementor
See all- CVE-2026-39737Medium
The JetElements For Elementor plugin (Crocoblock) up to version 2.9.2.6 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
- CVE-2026-111414Medium
The JetElements For Elementor plugin up to version 2.9.2.4 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
- CVE-2026-107866Medium
The JetElements For Elementor plugin for WordPress up to version 2.9.2.3 contains a stored XSS vulnerability in the jet-elements function. The vulnerability is due to improper neutralization of input during web page generation.
- CVE-2026-105879Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.2 contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.
- CVE-2026-66579Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.1 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
- CVE-2026-65465Medium
The JetElements for Elementor plugin version 2.9.1.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
- CVE-2025-49939Medium
Stored XSS vulnerability in JetElements For Elementor up to version 2.7.8. An attacker can inject a malicious script that gets stored and executed in the user's browser.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS