EUVD-2026-40909
GHSA-xjv6-qwmr-5pf6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Author-level credential requirement justifies PR:L; payload stored and served via web (AV:N, AC:L); scope changes to victim browsers (S:C); no availability impact observed.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due to insufficient output escaping and missing server-side validation of the Animated Box widget's animation_effect setting before it is rendered inside an HTML class attribute. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in JetWidgets For Elementor (versions up to and including 1.0.21) allows authenticated WordPress users holding author-level access or higher to plant persistent JavaScript payloads by supplying unsanitized input to the Animated Box widget's animation_effect parameter, which is written directly into an HTML class attribute without output escaping or server-side validation. Any site visitor who loads an injected page triggers the payload, enabling session hijacking, credential theft, or administrative account takeover through privilege escalation within the victim's browser context. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, a fix has been committed to the WordPress plugin repository.
Technical ContextAI
JetWidgets For Elementor is a WordPress plugin developed by JetMonsters that extends the Elementor page builder with additional widget types. The affected component is the Animated Box widget, specifically how it processes and renders the animation_effect configuration field. According to the CPE string cpe:2.3:a:jetmonsters:jetwidgets_for_elementor:*:*:*:*:*:*:*:*, all versions are nominally in scope, with the description capping exploitable versions at 1.0.21. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), arising from two compounding failures: missing server-side input validation at save time and absent output escaping at render time. The value is injected into an HTML class attribute, a vector frequently overlooked because class attributes are perceived as non-executable - yet unsanitized class values can serve as XSS sinks in certain attribute injection patterns. The CVSS Changed Scope (S:C) reflects that while the attacker interacts with the WordPress application, the ultimate impact lands in a third-party user's browser context.
RemediationAI
Update JetWidgets For Elementor to a version newer than 1.0.21 as soon as a patched release is confirmed available in the WordPress plugin repository; the fix is present in changeset 3583305 (https://plugins.trac.wordpress.org/changeset/3583305/jetwidgets-for-elementor) but a specific tagged release version was not independently confirmed from available data - verify via the plugin's changelog before deploying. As an immediate compensating control, audit all WordPress user accounts and remove or demote to subscriber-level any author-role accounts granted to untrusted or unnecessary users, directly eliminating the attacker prerequisite; note this impacts editorial workflows on multi-author sites. Alternatively, disable the Animated Box widget specifically via Elementor's widget restriction settings or a role-based widget manager plugin, which removes the vulnerable attack surface without uninstalling the entire JetWidgets suite. Both workarounds carry operational trade-offs: role demotion disrupts content publishing, while widget disablement breaks existing pages that use the Animated Box component.
More in Jetwidgets For Elementor
View allThe JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attribute
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widg
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL
The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inc
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File upl
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Sit
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today