CVE-2026-105879
MediumCVSS 6.5Summary
The JetElements For Elementor plugin in versions up to and including 2.9.2.2 contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.
Risk Assessment
An attacker can store a malicious script that executes in other users' browsers, potentially leading to session theft or account takeover.
Recommendation
Update the JetElements For Elementor plugin to a version newer than 2.9.2.2 to fix the Stored XSS vulnerability.
Other vulnerabilities in JetElements For Elementor
See all- CVE-2026-65465Medium
The JetElements for Elementor plugin version 2.9.1.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
- CVE-2026-66579Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.1 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS