CVE-2026-65465
MediumCVSS 6.5Summary
The JetElements for Elementor plugin version 2.9.1.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or steal sensitive data.
Recommendation
Immediately update the JetElements plugin to the latest available version.
Other vulnerabilities in JetElements for Elementor
See all- CVE-2026-105879Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.2 contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.
- CVE-2026-66579Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.1 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS