Jetelements For Elementor
Monthly
Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.6.13. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.6.13. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.