Executive brief
JetWidgets For Elementor is a WordPress plugin used to add custom design elements to websites. A security flaw allows users with basic editing permissions to inject malicious scripts into website pages. If exploited, these scripts will run in the browsers of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
This vulnerability is a Stored Cross-Site Scripting (XSS) flaw located in the Animated Box widget of the JetWidgets For Elementor plugin. The root cause is the lack of server-side validation and insufficient output escaping of the 'animation_effect' setting before it is rendered within an HTML class attribute. An authenticated attacker with Author-level permissions or higher can exploit this by submitting malicious scripts through the widget settings. These scripts are then stored on the server and executed in the context of any user's browser who visits the affected page. The issue is addressed in versions following 1.0.21.
Affected products
- jetmonsters JetWidgets For Elementor up to and including 1.0.21
Timeline
- 2026-07-01: advisory: NVD and Wordfence published the vulnerability details.
- 2026-07-01: disclosed