The vulnerability is an improper neutralization of input during web page generation that allows an attacker to inject script code into the client’s browser. This DOM‑based XSS can execute arbitrary JavaScript in the context of the victim, potentially exposing session cookies, defacing content, or redirecting users to malicious sites. The weakness resides in the JetElements For Elementor plugin, and attackers do not need elevated privileges on the site to utilize it, as the flaw is publicly accessible through user‑controlled input fields in the plugin.

Crocsoblock JetElements For Elementor plugin, versions from the earliest release up through 2.7.12.2, is affected. Any WordPress installation that has this plugin installed and has not yet upgraded past 2.7.12.2 is at risk.

The CVSS score of 6.5 indicates a moderate impact with potential for permanent damage to a user session. EPSS is below 1%, suggesting low exploitation probability at the time of analysis. The vulnerability is not in the KEV catalog, so no publicly known exploits are cataloged. Attackers would likely embed malicious script via the plugin’s input fields and rely on browsers performing DOM manipulation, meaning the vector is web‑based and requires the victim to visit an affected page.