CVE-2026-105879: WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability

Q: Does exploitation require an authenticated attacker or victim interaction?

The CVSS vector indicates an attacker needs low-level privileges and user interaction. The attack can be conducted over the network and has low attack complexity.

Q: What is the expected impact of successful exploitation?

The CVSS vector rates confidentiality, integrity, and availability impact as low. It also indicates scope is changed.

Published Oct 6, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.

Affected Software

1 affected component

Crocoblock JetElements For Elementor<=2.9.2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Crocoblock JetElements For Elementor to a version that resolves this vulnerability.
Fixed in 2.9.2.3

Event History

Oct 6, 2026

CVE Published

via MITRE·08:08 AM

Data Sourced

via MITRE·08:08 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated attacker or victim interaction?

The CVSS vector indicates an attacker needs low-level privileges and user interaction. The attack can be conducted over the network and has low attack complexity.

What is the expected impact of successful exploitation?