JetElements For Elementor CVE-2026-114707

Exploitation requires an authenticated account with at least contributor/author-level privileges (PR:L) on a WordPress site running JetElements For Elementor version 2.9.2.5 or earlier, used to store the malicious payload, plus subsequent interaction by a victim (UI:R) who loads the page where the payload renders - typically an administrator, consistent with the scope change (S:C). The specific plugin feature, field, or parameter that fails to neutralize input is not described in the available sources. Limiting factors: the attacker needs valid low-privileged credentials, exploitation is not automatic (it depends on a victim viewing the affected content), and sites not running the vulnerable plugin/version are unaffected.

This is a moderate-severity stored XSS (CVSS 6.5) in the Crocoblock JetElements For Elementor WordPress plugin, and the available signals point to a manage-this-month priority rather than an emergency. The vuln.today decision label is 'this_month', not act_now/emergency. There is no CISA KEV listing and no EPSS score was supplied, so widespread or active exploitation is not indicated; the only reference is a Patchstack database entry, which is an advisory record, not verified working exploit code - so no public exploit is identified. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) tells a consistent story: network-reachable but requiring an authenticated contributor/author-level account (PR:L) to plant the payload and a victim's browser action (UI:R) to fire it, with a scope change (S:C) reflecting that the injected script executes in another user's session (typically an administrator). Impacts are rated Low across C/I/A, consistent with session-context script execution rather than direct server compromise. No signals conflict here; the main limiting factor is the authentication requirement, which keeps this below the severity of an unauthenticated flaw. EPSS and KEV data are simply absent, not contradictory.

An attacker with a low-privileged authenticated account (e.g., contributor or author per PR:L) on a WordPress site running JetElements For Elementor injects a malicious script into a plugin-controlled field that is stored and later rendered. When an administrator or other user views the affected page (UI:R), the script executes in their browser session, potentially enabling account takeover or admin-action forgery. No verified public exploit code is available; only a Patchstack advisory reference exists.