CVE-2026-107866: WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetElements For Elementorto a version that resolves this vulnerability.Fixed in 2.9.2.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access, a low-privileged account, and user interaction. The vector indicates exploitation can be performed remotely with low attack complexity.
What versions are affected?
JetElements For Elementor versions through 2.9.2.3 are affected. The available data does not identify a fixed version.
What is the likely impact if exploitation succeeds?
The issue allows stored cross-site scripting, meaning attacker-supplied script can be persisted and later run in another user’s browser. The listed impact includes low confidentiality, integrity, and availability effects, and the scope may extend beyond the vulnerable component.