JetElements For Elementor EUVD-2026-48077

Exploitation requires a valid WordPress user account with at minimum the Contributor role on the target site, as reflected by PR:L in the CVSS vector - unauthenticated exploitation is not possible. The target site must have JetElements For Elementor version 2.9.1.1 or earlier installed and active. A higher-privileged user (Administrator or Editor) must subsequently view or render the attacker-controlled content in their browser (UI:R), meaning the attack is not fully autonomous. Exploitation is constrained to WordPress installations using this specific plugin; standard WordPress sites without JetElements For Elementor are unaffected. Sites that require manual approval for Contributor accounts, restrict that role to vetted internal staff, or enforce admin review workflows outside the browser (e.g., via staging environments) reduce the practical attack surface.

The CVSS 6.5 Medium score is driven by a network-accessible attack requiring only a low-privilege account (PR:L - Contributor role) with no complexity barrier (AC:L), but tempered by the requirement for victim interaction (UI:R). The Changed scope (S:C) is the most significant signal: the injected payload executes outside the contributor's own session, enabling effective privilege escalation to administrator-level access in practice. No EPSS data was provided in the intelligence, so exploitation probability cannot be quantified numerically. No CISA KEV listing exists and no POC availability was confirmed, indicating no confirmed or widespread active exploitation at time of analysis. Real-world priority is elevated for any WordPress site that permits open or low-friction Contributor registration, operates a multi-author workflow where admins routinely review submitted drafts, or has not restricted the Contributor role to fully trusted internal users - in these environments, the functional impact exceeds what the medium CVSS score implies. Sites with tight Contributor controls or no external author registration face substantially reduced risk.

An attacker registers or obtains a WordPress Contributor account on a target site running JetElements For Elementor ≤2.9.1.1, then creates a draft post or page embedding a malicious JavaScript payload inside a vulnerable JetElements widget field. When an Administrator or Editor reviews the draft, previews the page, or otherwise renders the content in their browser, the stored script executes in their authenticated session, allowing the attacker to exfiltrate session cookies or issue privileged WordPress REST API requests to create a new administrator account. No public proof-of-concept has been confirmed in the available data.