CVE-2026-39737
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The JetElements For Elementor plugin (Crocoblock) up to version 2.9.2.6 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
Risk Assessment
An attacker may inject a malicious script that executes in users' browsers, potentially leading to session or data theft.
Recommendation
Update JetElements For Elementor to a version newer than 2.9.2.6 as soon as it is available.
Other vulnerabilities in JetElements For Elementor
See all- CVE-2026-114707Medium
The JetElements For Elementor plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 2.9.2.5.
- CVE-2026-111414Medium
The JetElements For Elementor plugin up to version 2.9.2.4 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
- CVE-2026-107866Medium
The JetElements For Elementor plugin for WordPress up to version 2.9.2.3 contains a stored XSS vulnerability in the jet-elements function. The vulnerability is due to improper neutralization of input during web page generation.
- CVE-2026-105879Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.2 contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.
- CVE-2026-66579Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.1 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
- CVE-2026-65465Medium
The JetElements for Elementor plugin version 2.9.1.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
- CVE-2025-49939Medium
Stored XSS vulnerability in JetElements For Elementor up to version 2.7.8. An attacker can inject a malicious script that gets stored and executed in the user's browser.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS