What is the CVSS score of CVE-2026-65465?

CVE-2026-65465 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

JetElements For Elementor CVE-2026-65465

EUVD-2026-48077 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-c44p-cpp7-pw3q

WordPress XSS Wordpress Plugin Jetelements For Elementor Crocoblock Jetimpex Inc

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor authentication required (PR:L), scope changes to victim's browser session (S:C); availability impact absent as standard stored XSS execution does not disrupt service.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:27 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.

AnalysisAI

Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.

Technical ContextAI

JetElements For Elementor is a WordPress page-builder extension developed by Crocoblock (JetImpex Inc.), identified by CPE cpe:2.3:a:crocoblock._jetimpex_inc.:jetelements_for_elementor:*:*:*:*:*:*:*:*. It extends the Elementor visual editor with additional widgets for carousels, pricing tables, countdown timers, and similar design elements. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning contributor-supplied values entered into one or more JetElements widget fields are stored without adequate sanitization or output escaping, and are later rendered verbatim in other users' browsers. WordPress's contributor role is a low-trust role that can draft content but cannot publish - yet insufficient input handling here allows the role to persist malicious payloads that execute under higher-privileged sessions.

RemediationAI

Update JetElements For Elementor to a version beyond 2.9.1.1 once a patched release is available from Crocoblock; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-2-9-1-1-cross-site-scripting-xss-vulnerability for the confirmed fixed version, as no specific patched release number was present in the available intelligence. As an interim compensating control, restrict the WordPress Contributor role exclusively to fully trusted internal users and disable open registration for that role - this prevents external attackers from obtaining the low-privilege access required for exploitation, though it does not eliminate the vulnerability itself. A second mitigating layer is deploying a strict Content-Security-Policy header that disallows inline scripts; however, Elementor and its extensions rely heavily on inline JavaScript, so aggressive CSP enforcement is likely to break legitimate site functionality and requires careful per-site tuning. Temporarily deactivating the JetElements For Elementor plugin until a patch is confirmed is the most reliable short-term mitigation on sensitive sites.