The vulnerability is a stored XSS flaw in JetElements For Elementor that fails to neutralise user input before rendering it in a web page. This defect allows an attacker who can supply malicious script content in the plugin's editable fields to have that code executed in the browsers of any visitor to the affected site, potentially leading to credential theft, session hijacking or defacement. The issue is recorded as CWE-79.

The affected product is the Crocoblock JetElements For Elementor WordPress plugin, versions up to and including 2.9.2.3. Any WordPress site that has installed a vulnerable version of this plugin and has exposed its editable features is susceptible to the flaw. The vulnerability originates from the plugin's handling of user-controlled data during page generation.

The CVSS score of 6.5 indicates a moderate to high impact of the vulnerability. The EPSS score is not available, and CISA does not list the issue in its KEV catalog. The most likely attack vector involves an attacker who can submit content to the plugin's fields—such as an authenticated user with content-creation privileges—embedding malicious scripts that will be served to all site visitors. Since the vulnerability is stored XSS, it can compromise the integrity and confidentiality of user sessions and the trustworthiness of the site’s content.