CVE-2026-105879: JetElements For Elementor XSS Vulnerability

CVE-2026-105879 Overview

CVE-2026-105879 is a stored cross-site scripting (XSS) vulnerability in the Crocoblock JetElements For Elementor WordPress plugin. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Attackers with low-privileged authenticated access can inject malicious scripts that persist in the application and execute in the browsers of users who view the affected pages. The issue affects JetElements For Elementor versions up to and including 2.9.2.2. Successful exploitation requires user interaction and crosses a security scope boundary, meaning injected payloads can impact components beyond the vulnerable plugin.

Critical Impact
Authenticated attackers can inject persistent JavaScript payloads into WordPress pages, enabling session hijacking, credential theft, and administrative action abuse against site visitors and administrators.

Affected Products

Crocoblock JetElements For Elementor (jet-elements) plugin for WordPress
All versions from unspecified initial release through 2.9.2.2
WordPress sites running the Elementor page builder with JetElements installed

Discovery Timeline

2026-10-06 - CVE-2026-105879 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105879

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the JetElements For Elementor plugin, a widget library used to extend the Elementor page builder. User-supplied input is accepted by one or more plugin components and later rendered into web pages without adequate sanitization or output encoding. The injected payload is stored server-side, typically in the WordPress database as post content or widget configuration, and executes each time an unsuspecting visitor loads the affected page.

Exploitation requires authenticated access with low privileges, such as a contributor or author role that can edit Elementor content. The attack also requires user interaction, meaning a victim must view a page containing the stored payload. Because the vulnerability has a changed scope, injected scripts can affect resources outside the plugin's security boundary, including administrative sessions.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin fails to apply WordPress sanitization functions such as wp_kses_post(), esc_attr(), or esc_html() to data flowing from widget configuration fields into rendered HTML. Attacker-controlled attribute values or markup are emitted directly into the DOM, allowing arbitrary JavaScript execution.

Attack Vector

The attack vector is network-based. An authenticated attacker edits an Elementor page or JetElements widget and submits a crafted payload in a field that lacks proper validation. When an administrator or other site visitor renders the page, the browser parses the stored markup and executes the attacker's JavaScript in the context of the site origin. This enables theft of authentication cookies, forced actions on behalf of the victim, and redirection to attacker-controlled infrastructure.

Technical details are available in the Patchstack advisory for JetElements For Elementor.

Detection Methods for CVE-2026-105879

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handlers such as onerror=, onload=, or onmouseover= inside WordPress post content or JetElements widget options stored in wp_postmeta
Outbound requests from administrator browsers to unfamiliar domains shortly after loading pages containing JetElements widgets
New or modified administrator accounts created without a corresponding legitimate action in audit logs

Detection Strategies

Audit the wp_posts and wp_postmeta tables for Elementor data containing HTML event handlers or script tags inserted by non-administrator users
Deploy a web application firewall rule set that flags XSS patterns in POST requests to /wp-admin/admin-ajax.php and Elementor save endpoints
Review user role assignments and recent content changes made by contributor and author accounts

Monitoring Recommendations

Enable detailed WordPress audit logging for post edits, user role changes, and plugin configuration changes
Monitor browser Content Security Policy (CSP) violation reports to surface inline script execution attempts
Alert on anomalous session activity from administrator accounts, including unexpected privilege changes or API calls

How to Mitigate CVE-2026-105879

Immediate Actions Required

Update the JetElements For Elementor plugin to a version newer than 2.9.2.2 as soon as Crocoblock publishes a fixed release
Review contributor, author, and editor accounts and revoke access for untrusted or inactive users
Scan existing Elementor content for stored payloads and remove any malicious markup identified

Patch Information

At the time of publication, the NVD entry lists affected versions through 2.9.2.2 without a fixed version identifier. Consult the Patchstack advisory and the Crocoblock changelog for the latest fixed version and apply it site-wide.

Workarounds

Restrict content editing permissions so only trusted administrators can create or modify Elementor pages
Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Place the WordPress site behind a web application firewall configured to block common XSS payloads targeting Elementor endpoints

bash

# Example Content Security Policy header to limit inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self' https://trusted-cdn.example; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"