Live › vulnerability › CVE-2026-39737
JetElements For Elementor, a WordPress plugin from Crocoblock, fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can save crafted content can run scripts in other visitors' browsers, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the JetElements For Elementor plugin (jet-elements) at version 2.9.2.6 or earlier, where Elementor is used to build pages. The flaw needs a way for content to be stored, so sites where only trusted editors can write content have lower exposure. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
jet-elements plugin header.2.9.2.6.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-39737")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.