CVE-2026-66579: WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The issue is described as contributor XSS, so an attacker needs Contributor-level access to the affected WordPress site. The vector is network-accessible and has low attack complexity.

Q: Does exploitation require interaction from another user?

Yes. The supplied CVSS vector includes UI:R, indicating user interaction is required for exploitation.

Q: What security impact can successful exploitation have?

The CVSS vector indicates low impacts to confidentiality, integrity, and availability, with scope changed. This means the vulnerability may affect resources beyond the initially vulnerable security authority.

Published Sep 17, 2026

Updated

Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.

Affected Software

1 affected component

WordPress JetElements For Elementor<=2.9.2.1

Event History

Sep 17, 2026

CVE Published

via MITRE·01:24 PM

Data Sourced

via MITRE·01:24 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue is described as contributor XSS, so an attacker needs Contributor-level access to the affected WordPress site. The vector is network-accessible and has low attack complexity.

Does exploitation require interaction from another user?

Yes. The supplied CVSS vector includes UI:R, indicating user interaction is required for exploitation.

What security impact can successful exploitation have?