The JetElements plugin for WordPress contains a stored cross‑site scripting flaw that affects several widgets. The vulnerability allows an attacker with contributor‑level or higher permissions to insert arbitrary JavaScript into user‑supplied widget attributes. When an affected user visits the page where the widget is displayed, the malicious script executes in the victim’s browser and can perform any actions permitted by the script context.

Crocoblock’s JetElements WordPress plugin is vulnerable in all releases up to and including version 2.7.2.1. Any installation that uses the affected widgets on a WordPress site is at risk. Versions newer than 2.7.2.1 have been patched.

The CVSS score of 6.4 indicates a medium‑severity risk, while an EPSS score below 1 % signifies a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated contributor‑level access, the risk is mitigated to the extent that such roles are restricted or inaccessible to potential attackers. Exploitation hinges on the attacker being able to input data into the vulnerable widget attributes, which the code then fails to sanitize before rendering.