JetElements For Elementor EUVD-2026-104255

Exploitation requires an authenticated WordPress account with at least low-level content-contribution privileges (PR:L) to inject the stored payload into a JetElements For Elementor widget, and it additionally requires victim user interaction (UI:R) - another user, typically an administrator, must view or edit the page where the payload is stored before the script fires. The plugin (JetElements For Elementor, versions through 2.9.2.4) must be installed and active, and the site must permit lower-privileged users to author or edit content for the authentication barrier to be meaningful; on sites where only trusted administrators can create content, the prerequisite account access sharply limits realistic exploitation.

This is a moderate-severity Stored XSS (CWE-79) in the Crocoblock JetElements For Elementor WordPress plugin, scored CVSS 6.5. The provided vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation that nonetheless requires authentication (PR:L) and victim user interaction (UI:R) - meaning an attacker must already hold a low-privileged authenticated account (typically contributor/author level in WordPress) and must wait for another user, usually an administrator, to render the injected content. These two constraints meaningfully reduce real-world risk versus a pure unauthenticated flaw. No EPSS score, CISA KEV listing, POC, or SSVC data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only signal that this is a real stored XSS is the Patchstack database entry. The scope change (S:C) reflects that injected script executes in another user's browser context, which is the typical and expected scoring for stored XSS in a page-builder plugin. Net assessment: a credible but not urgent issue - prioritize patching on sites that allow lower-privileged content contributors, deprioritize on single-admin sites where the authentication prerequisite is effectively self-targeting.

An attacker holding a low-privileged authenticated WordPress account (e.g., contributor or author) on a site using JetElements For Elementor injects a malicious JavaScript payload into a vulnerable JetElements widget field that is not properly sanitized. When an administrator later edits or views the page containing that widget, the stored script executes in the admin's browser session, enabling actions such as session/cookie theft or admin-context requests. No public exploit code is identified at time of analysis.