The vulnerability in JetElements For Elementor allows an attacker to store malicious script code within a WordPress site through improper input neutralization. An injected script executes whenever a page containing the affected content is displayed, enabling attackers to hijack sessions, deface content, or redirect users to malicious sites.

Any WordPress installation that has the JetElements For Elementor plugin installed in a version up to and including 2.9.2.4 is affected. This includes all custom widgets and elements provided by the plugin that accept user‑supplied input. The vendor responsible for the fix is Crocoblock, and the update path is to the next released version.

The CVSS score of 6.5 indicates a moderate risk level. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting lower current exploitation probability. However, the flaw is stored XSS, which can be exploited through the front‑end or admin interfaces to inject code that runs in a visitor's browser when the compromised content is displayed. The likely attack vector is a web request to the plugin’s input endpoint, possibly requiring an account with permissions to edit content. Because the exploit materializes only after the script is stored and served, it may be harder to detect but still has significant impact if the site hosts privileged administrative users.