CVE-2026-66579
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The JetElements For Elementor plugin in versions up to and including 2.9.2.1 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.
Risk Assessment
The injected script may execute in the browsers of other users, including administrators, enabling session theft or account takeover. This can lead to full compromise of the WordPress site.
Recommendation
Update the JetElements For Elementor plugin to a version newer than 2.9.2.1. Until then, limit the number of accounts with Contributor privileges.
Other vulnerabilities in JetElements For Elementor
See all- CVE-2026-105879Medium
The JetElements For Elementor plugin in versions up to and including 2.9.2.2 contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.
- CVE-2026-65465Medium
The JetElements for Elementor plugin version 2.9.1.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS