CVE-2026-39737: WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetElements For Elementorto a version that resolves this vulnerability.Fixed in 2.9.2.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs at least low-level privileges in the affected WordPress environment and must induce a user to interact with the injected content. The attack can be performed over the network.
What versions are affected?
JetElements For Elementor versions through 2.9.2.6 are affected. The provided information does not identify a fixed version.
What is the likely impact if exploitation succeeds?
The vulnerability permits stored cross-site scripting. The supplied CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed.
How can I determine whether my site is affected?
Check whether JetElements For Elementor is installed and identify its version. An installation running version 2.9.2.6 or an earlier affected version should be treated as vulnerable based on the available information.