This vulnerability allows an attacker to inject malicious JavaScript code that is permanently stored in the WordPress site through the JetElements For Elementor plugin. When legitimate users view the stored content, the injected script executes in their browsers, enabling theft of session cookies, credential compromise, or defacement of the site. The weakness is a stored cross‑site scripting flaw (CWE‑79).

The issue affects Crocoblock’s JetElements For Elementor plugin for WordPress, including all versions from the earliest release through 2.9.2.2. The fix begins with version 2.9.2.3 and later releases. Sites running the plugin older than 2.9.2.3 should be upgraded to receive the patch that corrects input neutralization.

The CVSS score for this flaw is 6.5, indicating a medium‑severity risk. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, there is currently no reported evidence of exploitation. The likely attack vector requires the attacker to be able to submit content that the plugin will store and where the site’s users will later view it. If such an opportunity exists, the stored XSS can lead to widespread client‑side compromise across all visitors.