Vulnerabilities

TI-2025-00303 CVE-2025-0371 · GHSA-97wv-r25v-xc4x

Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

LOW 28

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user suppl…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00301 Published 2025-01-21 No fix listed CWE-79

TI-2024-06612 CVE-2024-7144 · GHSA-5jw4-r8w6-r7mq

JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output esca…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00263 Published 2024-08-16 No fix listed CWE-79

TI-2024-06613 CVE-2024-7145 · GHSA-58p8-qp66-2jq2

JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion

MEDIUM 42

The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00901 Published 2024-08-16 No fix listed CWE-22

TI-2023-26589 CVE-2023-48759 · GHSA-gqc7-6x42-qc68

WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerability

LOW 39

Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00399 Published 2024-06-19 No fix listed CWE-862

TI-2023-26590 CVE-2023-48760 · GHSA-g5g4-3wq4-6784

WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerability

HIGH 81

Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00445 Published 2024-06-19 No fix listed CWE-862

TI-2023-26591 CVE-2023-48761 · GHSA-cvh2-grpw-4xrw

WordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerability

LOW 28

Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00268 Published 2024-06-19 No fix listed CWE-862

TI-2023-20324 CVE-2023-39157 · GHSA-xqh4-7g56-wxh4

WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)

MEDIUM 40

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00716 Published 2023-12-31 No fix listed CWE-94

Vulnerabilities

Filters

Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion

WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerability

WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerability

WordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerability

WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)