Jetelements For Elementor
Monthly
Stored cross-site scripting in Crocoblock JetElements For Elementor (versions through 2.9.2.6) allows an authenticated user with low-level content-editing privileges to plant persistent script in a widget field, which then executes in the browser of any higher-privileged user who later views the affected page or admin screen. Rated CVSS 6.5 with scope change (S:C), reflecting that code runs in the victim's WordPress session context rather than the attacker's. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the required authenticated foothold plus victim interaction keeps it a medium-priority, this-month remediation item rather than an emergency.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (versions from n/a through 2.9.2.5) lets a low-privileged account - contributor or author level - persist a script payload that then executes in another user's browser, typically an administrator's, when the affected page is loaded. The plugin does not neutralize input before it is rendered into a web page (CWE-79), and because the CVSS vector carries a scope change (S:C), the injected script runs with the victim's privileges against the surrounding site rather than staying confined to the vulnerable component. Impact is bounded to confidentiality, integrity and availability at low severity, and no public exploit has been identified at time of analysis, with no CISA KEV entry; the current priority is manage-this-month rather than an emergency response.
Stored cross-site scripting in Crocoblock JetElements For Elementor through version 2.9.2.4 allows an authenticated WordPress user with low-level content privileges to inject a script into a JetElements widget; the payload executes when another user, such as an administrator, views or edits the affected page. The issue is rated CVSS 6.5 and requires victim interaction, so exploitation is constrained by content-authoring permissions and user behavior. No public exploit code or active exploitation was identified at time of analysis.
Stored cross-site scripting in Crocoblock's JetElements For Elementor WordPress plugin (all versions through 2.9.2.3) allows an attacker holding a low-privilege account on the target site to persist malicious script through a JetElements input field, which then executes in the browser of any user who views the affected page. The vulnerable path requires an authenticated user with at least contributor/author-level posting capability and depends on a victim later visiting the poisoned content; successful exploitation runs script under the site's own origin, enabling session or credential theft and content/administrative action injection against higher-privileged viewers. There is no public exploit identified at time of analysis and no confirmed active exploitation; the issue is rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) and no patched version is specified in the available advisory data.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (all versions through 2.9.2.2) allows an authenticated user with low privileges, such as a contributor or author, to inject persistent script content that executes in the browser of any other user who later views the affected page, including administrators. Per the independent assessment this is a Medium-severity issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requiring a valid low-privileged account and user interaction, so sites that do not grant untrusted users content-editing roles are substantially less exposed. There is no public exploit identified at time of analysis and no KEV listing, though the reported scope change (S:C) means the injected script can affect resources beyond the vulnerable component's original security context; the vulnerability was reported by Patchstack.
Stored cross-site scripting in JetElements For Elementor (Crocoblock / JetImpex Inc.) through version 2.9.2.1 allows an authenticated attacker holding the WordPress Contributor role or higher to embed script that executes when a higher-privileged user views or previews the poisoned widget content. It is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79) and the practical exposure is limited to sites that grant low-privilege authoring accounts to untrusted users, since a single-admin or closed-authorship site has essentially no attack surface; the plugin must be installed and active. No public exploit code was identified at time of analysis, the plugin is not listed in CISA KEV, and no EPSS signal was supplied in the source data.
Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.6.13. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in Crocoblock JetElements For Elementor (versions through 2.9.2.6) allows an authenticated user with low-level content-editing privileges to plant persistent script in a widget field, which then executes in the browser of any higher-privileged user who later views the affected page or admin screen. Rated CVSS 6.5 with scope change (S:C), reflecting that code runs in the victim's WordPress session context rather than the attacker's. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the required authenticated foothold plus victim interaction keeps it a medium-priority, this-month remediation item rather than an emergency.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (versions from n/a through 2.9.2.5) lets a low-privileged account - contributor or author level - persist a script payload that then executes in another user's browser, typically an administrator's, when the affected page is loaded. The plugin does not neutralize input before it is rendered into a web page (CWE-79), and because the CVSS vector carries a scope change (S:C), the injected script runs with the victim's privileges against the surrounding site rather than staying confined to the vulnerable component. Impact is bounded to confidentiality, integrity and availability at low severity, and no public exploit has been identified at time of analysis, with no CISA KEV entry; the current priority is manage-this-month rather than an emergency response.
Stored cross-site scripting in Crocoblock JetElements For Elementor through version 2.9.2.4 allows an authenticated WordPress user with low-level content privileges to inject a script into a JetElements widget; the payload executes when another user, such as an administrator, views or edits the affected page. The issue is rated CVSS 6.5 and requires victim interaction, so exploitation is constrained by content-authoring permissions and user behavior. No public exploit code or active exploitation was identified at time of analysis.
Stored cross-site scripting in Crocoblock's JetElements For Elementor WordPress plugin (all versions through 2.9.2.3) allows an attacker holding a low-privilege account on the target site to persist malicious script through a JetElements input field, which then executes in the browser of any user who views the affected page. The vulnerable path requires an authenticated user with at least contributor/author-level posting capability and depends on a victim later visiting the poisoned content; successful exploitation runs script under the site's own origin, enabling session or credential theft and content/administrative action injection against higher-privileged viewers. There is no public exploit identified at time of analysis and no confirmed active exploitation; the issue is rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) and no patched version is specified in the available advisory data.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (all versions through 2.9.2.2) allows an authenticated user with low privileges, such as a contributor or author, to inject persistent script content that executes in the browser of any other user who later views the affected page, including administrators. Per the independent assessment this is a Medium-severity issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requiring a valid low-privileged account and user interaction, so sites that do not grant untrusted users content-editing roles are substantially less exposed. There is no public exploit identified at time of analysis and no KEV listing, though the reported scope change (S:C) means the injected script can affect resources beyond the vulnerable component's original security context; the vulnerability was reported by Patchstack.
Stored cross-site scripting in JetElements For Elementor (Crocoblock / JetImpex Inc.) through version 2.9.2.1 allows an authenticated attacker holding the WordPress Contributor role or higher to embed script that executes when a higher-privileged user views or previews the poisoned widget content. It is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79) and the practical exposure is limited to sites that grant low-privilege authoring accounts to untrusted users, since a single-admin or closed-authorship site has essentially no attack surface; the plugin must be installed and active. No public exploit code was identified at time of analysis, the plugin is not listed in CISA KEV, and no EPSS signal was supplied in the source data.
Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.6.13. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.