Crocoblock JetElements For Elementor plugin allows stored cross‑site scripting because input from users is not neutralized before being rendered on pages. An attacker can embed malicious JavaScript that persists in the site’s content. When a visitor loads the affected page, the injected script runs in the visitor’s browser, which can lead to session hijacking, cookie theft, or site defacement.

WordPress installations that have the JetElements For Elementor plugin installed in any version up to and including 2.7.9 are affected. The flaw applies across all releases from the earliest available through 2.7.9.

The CVSS v3 base score of 6.5 reflects moderate risk. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would need to inject malicious code through an administrative or trusted user account that can edit content or widgets; once persisted, any user viewing the page would be affected.