The vulnerability consists of inserting sensitive information into sent data, enabling the retrieval of embedded sensitive data that should otherwise be hidden. This defect permits an attacker to read confidential content exposed through the plugin’s interfaces, thereby compromising data confidentiality for affected users.

The affected systems are WordPress installations running the Crocoblock JetElements For Elementor plugin version 2.7.7 or earlier.

The CVSS score of 6.5 classifies the flaw as a moderate‑severity data exposure. EPSS is less than 1 %, indicating a low likelihood of exploitation, and it is not catalogued in CISA KEV. The attack vector is inferred to be a legitimate request through the plugin’s front‑end endpoints; an attacker with access to the site can exploit this to exfiltrate concealed data. Overall risk is moderate but the exploitation probability remains low.