{"id":"CVE-2026-114707","kind":"vulnerability","aliases":["CVE-2026-114707"],"related":[],"title":"JetElements for Elementor: stored XSS through 2.9.2.5 lets scripts run","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5.","summary":"JetElements For Elementor, a WordPress plugin from Crocoblock, fails to neutralize input when generating pages, so a stored cross-site scripting flaw exists in versions through 2.9.2.5. An attacker who can get a payload saved can run script in the browser of anyone who views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","jetelements","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the JetElements For Elementor plugin (`jet-elements`) in the WordPress admin plugin list or `wp plugin get jet-elements --field=version`\n- Confirm whether the plugin is active on any public page","fix":"- Update the JetElements For Elementor plugin (`jet-elements`) to a version later than `2.9.2.5` once the vendor ships one; the sources do not name the fixed version\n- Until patched, limit who can create or edit Elementor content","status":"open","published_at":"2026-10-26T11:16:33+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:31:10+00:00","updated_at":"2026-10-26T11:31:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T11:31:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the JetElements For Elementor plugin (`jet-elements`) to a version later than `2.9.2.5` once the vendor ships one; the sources do not name the fixed version\n- Until patched, limit who can create or edit Elementor content","reach":"internet","title":"JetElements for Elementor: stored XSS through 2.9.2.5 lets scripts run","impact":"medium","summary":"JetElements For Elementor, a WordPress plugin from Crocoblock, fails to neutralize input when generating pages, so a stored cross-site scripting flaw exists in versions through 2.9.2.5. An attacker who can get a payload saved can run script in the browser of anyone who views the affected page.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","jetelements"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, stealing sessions or actions","analyst_note":"Confirm the fixed version and whether low-privilege authenticated users can store the payload; check the NVD entry and the vendor changelog.","how_to_check":"- Check the installed version of the JetElements For Elementor plugin (`jet-elements`) in the WordPress admin plugin list or `wp plugin get jet-elements --field=version`\n- Confirm whether the plugin is active on any public page","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the JetElements For Elementor plugin at version 2.9.2.5 or earlier, most likely WordPress sites built with Elementor where editors or contributors can save content. Sites without the plugin installed can skip it. The sources do not say whether unauthenticated users can store the payload.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":3319,"output_tokens":637,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114707':13A,16A '-2026':12A,15A '2.9.2.5':7A,48B,102C 'affect':68B,95C 'allow':91C 'anyon':64B 'attack':50B 'browser':62B 'crocoblock':28B,84C 'cross':40B,79C 'cross-sit':39B,78C 'cve':11A,14A 'element':90C 'elementor':3A,17B,23B,87C,98C 'exist':44B 'fail':29B 'flaw':43B 'generat':34B,77C 'get':53B 'improp':70C 'input':32B,73C 'issu':94C 'jet':89C 'jet-el':88C 'jetel':1A,18B,21B,85C,96C 'let':8A 'n/a':100C 'neutral':31B,71C 'packag':19B 'page':35B,69B,76C 'payload':55B 'plugin':26B 'run':10A,58B 'save':56B 'script':9A,42B,59B,81C 'site':41B,80C 'store':4A,38B,92C 'version':46B 'view':66B 'vulner':82C 'web':75C 'wordpress':20B,25B 'xss':5A 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetElements For Elementor plugin at version 2.9.2.5 or earlier, most likely WordPress sites built with Elementor where editors or contributors can save content. Sites without the plugin installed can skip it. The sources do not say whether unauthenticated users can store the payload.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114707","severity":null,"published_at":"2026-10-26T11:16:33+00:00","modified_at":"2026-10-26T11:16:33+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}