CVE-2026-114707: WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetElements For Elementorto a version that resolves this vulnerability.Fixed in 2.9.2.6
Event History
Frequently Asked Questions
What access and interaction are required to exploit this issue?
The vector is network-accessible, the attack complexity is low, and exploitation requires low-privileged access. A user must also interact with the malicious content for the XSS to execute.
Which installations are affected?
JetElements For Elementor versions through 2.9.2.5 are affected. The available data does not state whether any particular WordPress or plugin configuration is required.
What is the potential impact?
This is stored XSS with low confidentiality, integrity, and availability impact. The scope is changed, indicating the vulnerable component could affect another security authority.