The vulnerability is an improper neutralization of user input during web page generation, allowing stored cross‑site scripting. A malicious user can inject JavaScript that will be executed in the browsers of anyone who views a page containing the compromised content. This can lead to session hijacking, defacement, or the execution of arbitrary scripts within the site’s context. The weakness is classified as CWE‑79.

Crocoblock’s JetElements For Elementor plugin is affected in all releases up to and including 2.9.2.5. Users running any of those versions on their WordPress installations are susceptible. The patch is available from version 2.9.2.6 onward, which removes the vulnerability by properly sanitizing input before storage and output.

The CVSS base score of 6.5 indicates moderate severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not known to be actively exploited in the wild. Still, the attack vector is likely from any user who can supply data that the plugin stores and later renders, such as widget settings or content blocks. If the attacker gains write access to these inputs, they can implant persistent scripts that will run for every site visitor. Successful exploitation would give the attacker code execution in the context of the site owner’s browser, potentially compromising user data, credentials, and the site’s reputation.