CVE-2026-11380: JetWidgets For Elementor XSS Vulnerability

CVE-2026-11380 Overview

CVE-2026-11380 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the JetWidgets For Elementor plugin for WordPress in versions up to and including 1.0.21. The flaw resides in the Animated Box widget, where the animation_effect setting is rendered inside an HTML class attribute without sufficient output escaping or server-side validation. Authenticated attackers with author-level access or above can inject arbitrary JavaScript that executes when other users visit an affected page. The vulnerability is classified under CWE-79.

Critical Impact
Authenticated attackers with author-level privileges can inject persistent JavaScript payloads that execute in the browser context of any visitor, enabling session theft, administrative action forgery, and malicious redirects.

Affected Products

JetWidgets For Elementor plugin for WordPress
All versions up to and including 1.0.21
WordPress sites that expose author-level (or higher) accounts to untrusted users

Discovery Timeline

2026-07-01 - CVE CVE-2026-11380 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-11380

Vulnerability Analysis

The JetWidgets For Elementor plugin provides an Animated Box widget that accepts an animation_effect configuration value from authenticated editors. The plugin writes this value directly into the class attribute of the widget's rendered HTML container. Because the plugin performs neither server-side validation of allowed effect names nor context-appropriate output escaping, an attacker can break out of the class attribute and inject arbitrary HTML or JavaScript.

The payload is stored in the WordPress database as part of the Elementor page data. Every subsequent view of the affected page — including views by administrators — triggers execution of the injected script in the visitor's browser session. This creates a persistence mechanism suitable for privilege escalation, credential harvesting, and lateral movement to administrator accounts.

Root Cause

The root cause is missing input validation and output escaping on the animation_effect widget setting. The plugin trusts editor-supplied values and concatenates them into an HTML class attribute without applying esc_attr() or restricting values to a known allow-list. Author-level users in WordPress can create and edit posts, which brings this attacker-controlled path within reach of any account at that privilege tier or higher.

Attack Vector

An attacker first authenticates to WordPress with an author, editor, or administrator account. The attacker then edits a post or page using the Animated Box widget and supplies a crafted animation_effect value containing an attribute-breaking payload followed by an event handler such as onmouseover or an injected <script> tag. When the page is published and rendered, the payload executes in the browser of every visitor. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for the corrective patch. Verified proof-of-concept code is not currently published, so no exploitation snippet is included here.

Detection Methods for CVE-2026-11380

Indicators of Compromise

Elementor widget records in wp_postmeta containing animation_effect values with quote characters, angle brackets, or the strings on, script, or javascript:
Unexpected <script> tags, event handlers, or encoded payloads appearing inside class attributes on pages using JetWidgets Animated Box
Outbound requests from visitor browsers to attacker-controlled domains shortly after loading pages with the Animated Box widget
New or modified posts authored by low-privilege accounts that include JetWidgets Animated Box elements

Detection Strategies

Query wp_postmeta for _elementor_data rows and inspect stored animation_effect settings for characters outside the plugin's expected effect names
Deploy a web application firewall rule that inspects rendered pages for script content inside class attributes on JetWidgets containers
Enable WordPress audit logging to correlate post edits from author-level accounts with subsequent XSS alerts

Monitoring Recommendations

Alert on unexpected creation or promotion of author-level accounts
Monitor administrator sessions for anomalous actions immediately after they view content authored by lower-privileged users
Track browser console errors and Content Security Policy violations reported by administrator browsers

How to Mitigate CVE-2026-11380

Immediate Actions Required

Update the JetWidgets For Elementor plugin to a version later than 1.0.21 that contains the fix from WordPress plugin changeset 3583305
Audit all existing pages using the Animated Box widget and remove any animation_effect values that are not on the plugin's documented allow-list
Review author-level and above accounts, revoke unnecessary privileges, and reset credentials for accounts that may have been used to store payloads

Patch Information

The vendor addressed the vulnerability in the JetWidgets For Elementor plugin via changeset 3583305, which adds server-side validation and proper output escaping for the animation_effect setting. Site operators should upgrade to the first release that includes this changeset. Additional context is available in the Wordfence Vulnerability Analysis.

Workarounds

Temporarily deactivate the JetWidgets For Elementor plugin until the patched version is deployed
Restrict author-level and editor accounts to trusted users only, and require multi-factor authentication for all content contributors
Deploy a strict Content Security Policy that blocks inline scripts and disallows event handler attributes on published pages

bash

# Update the plugin from the command line using WP-CLI
wp plugin update jetwidgets-for-elementor

# Verify the installed version is beyond 1.0.21
wp plugin get jetwidgets-for-elementor --field=version

# Restrict the author role from using unfiltered HTML (defense in depth)
wp cap remove author unfiltered_html