{"id":"CVE-2026-111414","kind":"vulnerability","aliases":["CVE-2026-111414"],"related":[],"title":"JetElements for Elementor: stored XSS lets page input run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4.","summary":"JetElements For Elementor, a WordPress plugin from Crocoblock, does not neutralize some input before writing it into a web page, so the input is stored and later served. An attacker who can submit such input can run scripts in the browser of anyone who views the page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","jet-elements","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed JetElements for Elementor version in the WordPress plugins list or `wp plugin get jet-elements --field=version`\n- unknown","fix":"- Update JetElements For Elementor (jet-elements) to a version later than `2.9.2.4`\n- unknown","status":"open","published_at":"2026-10-19T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:57:03+00:00","updated_at":"2026-10-25T03:57:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:57:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update JetElements For Elementor (jet-elements) to a version later than `2.9.2.4`\n- unknown","reach":"internet","title":"JetElements for Elementor: stored XSS lets page input run scripts","impact":"medium","summary":"JetElements For Elementor, a WordPress plugin from Crocoblock, does not neutralize some input before writing it into a web page, so the input is stored and later served. An attacker who can submit such input can run scripts in the browser of anyone who views the page.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","jet-elements"],"confidence":0.6,"needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, enabling session theft or account actions","analyst_note":"Confirm the minimum role needed to store the input, the fixed version, and whether the fix is in a specific release, from the NVD page and the vendor changelog.","how_to_check":"- Check the installed JetElements for Elementor version in the WordPress plugins list or `wp plugin get jet-elements --field=version`\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running JetElements For Elementor version `2.9.2.4` or earlier, where users with permission to add or edit page content can store input that other visitors later load. The sources do not say which roles or settings are needed. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000597,"input_tokens":3319,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111414':13A,16A '-2026':12A,15A '2.9.2.4':102C 'affect':95C 'allow':91C 'anyon':65B 'attack':52B 'browser':63B 'crocoblock':30B,84C 'cross':79C 'cross-sit':78C 'cve':11A,14A 'element':20B,90C 'elementor':3A,17B,25B,87C,98C 'generat':77C 'improp':70C 'input':8A,35B,45B,57B,73C 'issu':94C 'jet':19B,89C 'jet-el':18B,88C 'jetel':1A,23B,85C,96C 'later':49B 'let':6A 'n/a':100C 'neutral':33B,71C 'packag':21B 'page':7A,42B,69B,76C 'plugin':28B 'run':9A,59B 'script':10A,60B,81C 'serv':50B 'site':80C 'store':4A,47B,92C 'submit':55B 'view':67B 'vulner':82C 'web':41B,75C 'wordpress':22B,27B 'write':37B 'xss':5A 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running JetElements For Elementor version `2.9.2.4` or earlier, where users with permission to add or edit page content can store input that other visitors later load. The sources do not say which roles or settings are needed. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T13:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111414","severity":null,"published_at":"2026-10-19T13:16:55+00:00","modified_at":"2026-10-19T19:17:22+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}