JetElements For Elementor CVE-2026-39737

Exploitation requires an authenticated WordPress account with at least low-level content-editing privileges (consistent with PR:L) able to supply input to a JetElements For Elementor widget field, on a site running the plugin at version 2.9.2.6 or earlier together with Elementor. Because this is stored XSS with UI:R, the payload only triggers when another user - typically a higher-privileged administrator - subsequently views the page or admin screen containing the stored content; it does not fire automatically. The specific widget field and parameter that fail neutralization are not described in the available sources. Limiting factors: the attacker must already be authenticated, a victim must view the injected content, and the site must run the vulnerable plugin version.

This is a medium-severity stored XSS (CVSS 6.5, CWE-79) in the Crocoblock JetElements For Elementor WordPress plugin. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity flaw that nonetheless requires some authenticated privilege (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser context. Signals are consistent but modest: there is no CISA KEV listing, so this is not confirmed actively exploited; no EPSS score was supplied, so a quantitative exploitation probability cannot be stated; and the only reference is a Patchstack database entry, not verified working exploit code, so no public exploit is identified at time of analysis. The vuln.today priority of 'this_month' aligns with a real-but-non-emergency item: the privilege and user-interaction requirements, combined with only Low impact across confidentiality, integrity and availability, make this a patch-in-routine-cycle issue rather than a drop-everything priority. The main caveat is missing data - no EPSS, no KEV, no explicit fixed version, and no independent corroboration beyond the single Patchstack reference.

An attacker holding a low-privileged authenticated WordPress account (e.g. contributor/author able to edit Elementor content) injects a malicious script payload into a JetElements widget field that is stored without proper neutralization. When a higher-privileged user such as an administrator later views the affected page or post in wp-admin, the stored script executes in their browser session. No working public exploit code is identified; only a Patchstack database reference exists.