Stored XSS Vulnerability in JetElements For Elementor (CVE-2026-105879)

What Happened

A vulnerability classified as Improper Neutralization of Input During Web Page Generation (CWE-79), commonly known as stored Cross-Site Scripting (XSS), was disclosed for the JetElements For Elementor plugin. Stored XSS vulnerabilities allow malicious script content to be saved by the application and later executed in the browser of users who view the affected content.

Technical Cause

The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing injected script content to be stored and later rendered as active content when the affected page is viewed. This is categorized under CWE-79 (Cross-Site Scripting).

Why It Matters

The vulnerability has a CVSS base score of 6.5, reflecting a network-exploitable issue that requires low attacker privileges and user interaction, with a scope change and limited impact to confidentiality, integrity, and availability. Because the flaw is stored (persistent), malicious content could remain active on a site and affect multiple visitors or administrators who interact with the compromised content until it is removed or the plugin is patched.

Who Is Affected

Websites using the JetElements For Elementor plugin (developed by Crocoblock) in versions up to and including 2.9.2.2 are affected. This plugin is reported to be used on a substantial number of WordPress sites, increasing the potential scope of exposure.

Affected Versions

JetElements For Elementor versions through 2.9.2.2 are affected. A version identified as 2.9.2.3 appears in the plugin's version-tracking data as a boundary reference, but the fact package does not confirm that this version resolves the vulnerability. Site owners should verify directly with the vendor before assuming a fix is available.

Fixes and Mitigation

No confirmed fix has been verified at this time. The fact package does not provide evidence that a patched release has been officially confirmed as resolving this vulnerability. Site owners should monitor the vendor's official channels for an update addressing CVE-2026-105879.

Recommended Action

Site administrators using JetElements For Elementor should check for plugin updates regularly, review the vendor's official changelog for a fix addressing this issue, and consider limiting access to content-editing capabilities to trusted users while a fix is pending. Monitoring stored content for unexpected script injections is also advisable as a precaution.