WordPress security by component

JetElements For Elementor

Plugin description

JetElements For Elementor adds additional Elementor widgets for creating WordPress page layouts, content sections, and interface components.

JetElements For Elementor (jet-elements) is a WordPress plugin with 20 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 9.

Plugin slug: jet-elements

Latest vulnerability

CVE-2026-39737: JetElements For Elementor: Stored cross-site scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 2.9.2.6.

PublishedOct 29, 2026

Known safe version2.9.2.7

Published vulnerabilities for jet-elements
		Safe version
Oct 29, 2026	CVE-2026-39737 JetElements For Elementor: Stored cross-site scripting Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 2.9.2.6.	2.9.2.7	CVE6.5
Oct 26, 2026	CVE-2026-114707 JetElements For Elementor: Stored cross-site scripting JetElements For Elementor <= 2.9.2.5 permits stored cross-site scripting: attacker-controlled content is persisted and later rendered without sufficient neutralization, allowing script to execute in a viewer’s browser under the affected site’s origin. The supplied CVSS vector requires a low-privilege authenticated attacker and victim interaction, but the export does not identify the minimum WordPress role, editable field, endpoint or rendering function. The resulting access is bounded by the viewing user’s browser context; an administrator victim or complete site takeover is not established.	2.9.2.6	CVE6.5
Oct 19, 2026	CVE-2026-111414 JetElements For Elementor: Stored cross-site scripting A low-privilege authenticated attacker can store script-bearing input that is later rendered without sufficient contextual escaping. A victim must view or otherwise interact with the affected content for script to execute under the site origin. The export does not identify the exact attacker role, stored field, endpoint, rendering function or victim role; an administrator victim is not established by this record. Affected versions: <= 2.9.2.4. The CNA identifies 2.9.2.5 as the fixed release.	2.9.2.5	CVE6.5
Oct 12, 2026	CVE-2026-107866 JetElements For Elementor: Stored cross-site scripting Attacker-controlled input is stored and later rendered without sufficient neutralization, allowing injected script to execute when a victim views the affected output. The CNA vector requires low privileges and victim interaction. The export does not name the minimum WordPress role, endpoint, input field, rendering function or victim role, so an administrator-targeting path is not established. Affected versions: <= 2.9.2.3. The authoritative export identifies 2.9.2.4 as fixed for this CVE.	2.9.2.4	CVE6.5
Oct 06, 2026	CVE-2026-105879 JetElements For Elementor: Stored cross-site scripting The supplied CVSS vector requires a low-privilege authenticated account; the minimum WordPress role is undisclosed. Attacker-controlled content is saved and later rendered without sufficient neutralization, allowing script execution under the site's origin when a victim encounters the affected output. The endpoint, field, rendering function and victim role are undisclosed. The supplied vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Victim interaction is required by the vector. Affected versions: <= 2.9.2.2. The authoritative export identifies 2.9.2.3 as fixed for this CVE.	2.9.2.3	CVE6.5
Sep 17, 2026	CVE-2026-66579 JetElements For Elementor allows contributor-level cross-site scripting JetElements For Elementor through 2.9.2.1 has a cross-site-scripting vulnerability requiring Contributor access. The disclosed XSS class allows attacker-influenced data to become executable browser content, and the CNA vector requires victim interaction. The export does not distinguish stored from reflected XSS or name the route, field, rendering function, output context or interaction needed; it does not establish which users can be targeted. The affected-version data marks 2.9.2.2 unaffected.	2.9.2.2	CVE6.5
Jul 23, 2026	CVE-2026-65465 JetElements For Elementor: Cross-site scripting JetElements For Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.9.1.1.	2.9.1.2	CVE6.5
Feb 03, 2026	CVE-2026-24958 JetElements For Elementor: Cross-site scripting JetElements For Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Dec 18, 2025	CVE-2025-64355 JetElements For Elementor: Cross-site scripting JetElements For Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Oct 22, 2025	CVE-2025-49939 JetElements For Elementor: Cross-site scripting JetElements For Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Aug 20, 2025	CVE-2025-53983 JetElements For Elementor: A security weakness JetElements For Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5
Aug 14, 2025	CVE-2025-55714 JetElements For Elementor: Cross-site scripting JetElements For Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Jul 16, 2025	CVE-2025-53982 JetElements For Elementor: Cross-site scripting JetElements For Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
May 19, 2025	CVE-2025-39447 JetElements For Elementor: A security weakness JetElements For Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5
May 19, 2025	CVE-2025-39448 JetElements For Elementor: Cross-site scripting JetElements For Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Jun 19, 2024	CVE-2023-48761 JetElements For Elementor: A security weakness JetElements For Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.3
Jun 19, 2024	CVE-2023-48760 JetElements For Elementor: A security weakness JetElements For Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE8.2
Jun 19, 2024	CVE-2023-48759 JetElements For Elementor: A security weakness JetElements For Elementor is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5
Dec 31, 2023	CVE-2023-39157 JetElements For Elementor: Code execution JetElements For Elementor is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE9.0
Dec 18, 2023	CVE-2023-48762 JetElements For Elementor: Cross-site request forgery JetElements For Elementor is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE6.3

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers