JetElements For Elementor CVE-2026-66579

Requires an authenticated account at Contributor role or higher on a WordPress site running JetElements For Elementor ≤ 2.9.2.1 (PR:L), plus victim interaction (UI:R) - a higher-privileged user must view or preview the attacker-authored content for the stored payload to fire. Exploitation is limited to sites that grant low-privilege authoring accounts to untrusted users; single-admin or closed-authorship sites have essentially no attack surface. The vulnerability is in the plugin's handling of user-supplied widget/field input, so the JetElements plugin must be installed and active.

This is a genuine but modest-severity issue, not a high-priority emergency. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) reflects a stored/Contributor-level Cross-Site Scripting flaw: network reachable and low-complexity, but gated behind authenticated access at Contributor privilege (PR:L) and requiring victim interaction (UI:R) to trigger the injected script. The scope change (S:C) and the uniform Low impacts (C:L/I:L/A:L) are typical of Patchstack's stored-XSS scoring where injected script executes in another user's browser session across a security boundary. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis' - this is a routine WordPress-plugin advisory rather than an actively weaponized bug. The main caveat is trust model: an attacker must already hold a Contributor account, so real-world risk concentrates on multi-author sites that provision low-privilege accounts to untrusted contributors. No signals conflict; the CVSS vector, description (Contributor XSS), and CWE-79 are mutually consistent.

An attacker who has registered or been granted a Contributor account on a WordPress site running JetElements For Elementor ≤ 2.9.2.1 injects a malicious script payload into a plugin-controlled field (e.g., a widget/shortcode attribute) when authoring content. When a higher-privileged user such as an editor or administrator later previews or views that content, the stored script executes in their authenticated browser session, potentially enabling session/cookie theft or actions on their behalf. No public exploit code is identified at time of analysis.