CVE-2025-49939
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Stored XSS vulnerability in JetElements For Elementor up to version 2.7.8. An attacker can inject a malicious script that gets stored and executed in the user's browser.
Risk Assessment
Risk of session theft, account takeover, or unauthorized actions in the context of a logged-in user.
Recommendation
Update the JetElements For Elementor plugin to the latest patched version.
Other vulnerabilities in JetElements For Elementor
See all- CVE-2026-111414Medium
The JetElements For Elementor plugin up to version 2.9.2.4 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
- CVE-2026-107866Medium
The JetElements For Elementor plugin for WordPress up to version 2.9.2.3 contains a stored XSS vulnerability in the jet-elements function. The vulnerability is due to improper neutralization of input during web page generation.
- CVE-2026-105879Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.2 contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.
- CVE-2026-66579Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.1 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
- CVE-2026-65465Medium
The JetElements for Elementor plugin version 2.9.1.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS