JetElements CVE-2026-107866

Requires an authenticated account with at least low-privilege posting capability (PR:L, e.g. contributor/author) to store the malicious payload via a JetElements For Elementor input field, and requires a victim to subsequently view the page containing the stored script (UI:R). Limiting factors: exploitation is gated by the attacker already having a valid low-privilege account on the target WordPress site and by the need for victim interaction, so sites that do not allow untrusted user registration or multi-author content are substantially less exposed. Affected only on JetElements For Elementor versions through 2.9.2.3.

This is a moderate-severity Stored XSS (CWE-79) carrying a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates a network-reachable but authenticated attack requiring at least low-level privileges (PR:L) plus victim interaction (UI:R), with a changed scope (S:C) reflecting that injected script executes in a different security context (the victim's browser/session). No EPSS score, CISA KEV listing, or public POC is present in the provided data, and the sole reference is the Patchstack advisory; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent - this is a realistic but not critical issue: the PR:L and UI:R requirements meaningfully constrain exploitation to scenarios where an attacker already holds a contributor/author-tier account and can lure or wait for a higher-privileged user to view the injected content. It is a genuine patch-worthy flaw for exposed multi-author WordPress sites rather than a drop-everything emergency; absent EPSS/KEV/POC data, widespread automated exploitation cannot be confirmed from the inputs.

A low-privileged authenticated user (e.g., a contributor or author) on a WordPress site running JetElements For Elementor ≤ 2.9.2.3 injects a malicious script payload through a vulnerable plugin input that is stored and later rendered. When an administrator or other user views the affected page or post, the script executes in their browser session, potentially enabling session/cookie theft or actions in the victim's context. No public exploit code was identified in the provided data.