JetElements For Elementor CVE-2026-105879

Exploitation requires an authenticated WordPress account with at least contributor/author-level privileges (CVSS PR:L) that can supply input to a JetElements For Elementor widget on sites running the plugin version n/a through 2.9.2.2. The payload is stored and only fires when another user - typically an administrator or site visitor - loads the affected page (CVSS UI:R), which is the key limiting factor along with the need for a valid low-privileged login. Sites that do not grant untrusted users content-editing roles are substantially less exposed.

This is a Medium-severity stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C) in the JetElements For Elementor WordPress plugin, reported by Patchstack. The CVSS vector indicates network-reachable, low-complexity exploitation but requires an authenticated account with at least low privileges (PR:L) and victim user interaction (UI:R); the scope change (S:C) reflects that injected script executes in other users' browser sessions. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This profile places it as a real but not emergency priority: the PR:L and UI:R requirements meaningfully limit mass automated exploitation, and the impact is the Low/Low/Low partial impact typical of stored XSS rather than direct server compromise. Treat as a standard-cadence patch item; the main conflicting/missing signal is the absence of any exploitation-probability data (EPSS) and the single-source (Patchstack-only) reference, which should be confirmed against the vendor changelog.

An attacker holding a low-privileged authenticated WordPress account (e.g., contributor or author) uses a JetElements widget field to save a malicious script payload into page content. When an administrator or other visitor later views the affected page, the stored script executes in their browser, enabling session/cookie theft or admin-context actions. No public PoC is identified in the provided data, and victim interaction (viewing the page) is required.