Jetwidgets For Elementor Vulnerabilities

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due to insufficient output escaping and missing server-side validation of the Animated Box widget's animation_effect setting before it is rendered inside an HTML class attribute...

CVSS:

6.4

Affected:

up to 1.0.21

Fixed in:

1.0.22

Disclosed:

Jun 30, 2026

CVE-2026-11380 on NVD →

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison and Subscribe widgets in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentic...

CVSS:

6.4

Affected:

up to 1.0.20

Fixed in:

1.0.21

Disclosed:

Dec 12, 2025

CVE-2025-8195 on NVD →

[en] The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and abov...

Affected:

up to 1.0.19

Fixed in:

1.0.19

Disclosed:

Nov 12, 2024

CVE-2024-10323 on NVD →

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVSS:

6.4

Affected:

up to 1.0.18

Fixed in:

1.0.19

Disclosed:

Nov 11, 2024

CVE-2024-10323 on NVD →

[en] The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...

Affected:

up to 1.0.18

Fixed in:

1.0.18

Disclosed:

Jun 20, 2024

CVE-2024-4626 on NVD →

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

CVSS:

6.4

Affected:

up to 1.0.17

Fixed in:

1.0.18

Disclosed:

Jun 19, 2024

CVE-2024-4626 on NVD →

[en] The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and a...

Affected:

up to 1.0.16

Fixed in:

1.0.16

Disclosed:

Apr 9, 2024

CVE-2024-2138 on NVD →

[en] The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with cont...

Affected:

up to 1.0.17

Fixed in:

1.0.17

Disclosed:

Apr 9, 2024

CVE-2024-2507 on NVD →

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribut...

CVSS:

6.4

Affected:

up to 1.0.16

Fixed in:

1.0.17

Disclosed:

Mar 20, 2024

CVE-2024-2507 on NVD →

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

CVSS:

6.4

Affected:

up to 1.0.15

Fixed in:

1.0.16

Disclosed:

Mar 13, 2024

CVE-2024-2138 on NVD →

[en] The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 1.0.14

Fixed in:

1.0.14

Disclosed:

Feb 13, 2023

CVE-2023-0034 on NVD →

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor...

CVSS:

6.4

Affected:

up to 1.0.13

Fixed in:

1.0.14

Disclosed:

Jan 19, 2023

CVE-2023-0034 on NVD →

[en] The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request grante...

Affected:

up to 1.0.14

Fixed in:

1.0.14

Disclosed:

Jan 5, 2023

CVE-2023-0086 on NVD →

The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted the...

CVSS:

5.4

Affected:

up to 1.0.12

Fixed in:

1.0.13

Disclosed:

Jan 4, 2023

CVE-2023-0086 on NVD →

[en] The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

May 5, 2021

CVE-2021-24268 on NVD →

The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

CVSS:

6.4

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

Apr 13, 2021

CVE-2021-24268 on NVD →

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered by WordFence in WordPress JetWidgets For Elementor plugin (versions <= 1.0.8).

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

Apr 13, 2021