JetElements

JetElements has 22 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 22 are fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2025 was the busiest year with 9 disclosures.

The most common weakness is Cross-Site Scripting, behind 14 of the records (64%). Other recurring categories include Missing Authorization, Code Injection.

Every one of the 22 issues recorded for JetElements has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (9) reported by stealthcopter.

01234567891003.08.2023Today03.08.20238.8JetElements <= 2.6.10 - Authenticated (Contributor+) Remote Code Execution CVSS 8.8 · 03.08.202328.11.20237.3Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action CVSS 7.3 · 28.11.20235.3JetElements For Elementor <= 2.6.13 - Missing Authorization to Unauthenticated Arbitrary Attachment Download CVSS 5.3 · 28.11.20236.3Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization CVSS 6.3 · 28.11.20234.3Multiple Plugins by Crocoblock <= (Various Versions) - Cross-Site Request Forgery CVSS 4.3 · 28.11.202315.08.20248.8JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion CVSS 8.8 · 15.08.20246.4JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 15.08.202420.01.20256.4Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVSS 6.4 · 20.01.202517.04.20256.4JetElements For Elementor <= 2.7.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 17.04.20255.3JetElements For Elementor <= 2.7.4.1 - Missing Authorization CVSS 5.3 · 17.04.202516.07.20254.3JetElements For Elementor <= 2.7.7 - Authenticated (Subscriber+) Information Disclosure CVSS 4.3 · 16.07.20256.4JetElements For Elementor <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 16.07.202503.08.20256.4JetElements For Elementor <= 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 03.08.202514.08.20256.4JetElements For Elementor <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 14.08.202506.11.20256.4JetElements For Elementor <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 06.11.202530.12.20256.4JetElements For Elementor <= 2.7.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 30.12.202522.07.20266.4JetElements <= 2.9.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 22.07.202617.09.20266.4JetElements <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 17.09.202606.10.20266.4JetElements <= 2.9.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 06.10.202612.10.20266.4JetElements <= 2.9.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 12.10.202619.10.20266.4JetElements <= 2.9.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 19.10.202626.10.20266.4JetElements <= 2.9.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 26.10.2026

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

22

Get automatic notifications for all JetElements vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-7145

JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion

Read the full analysis

Vulnerability Records

22 records
2026-10-26 10:28
JetElements <= 2.9.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.9.2.5
CVE-2026-114707
6.4
Medium
nh4tvdYes
2026-10-19 12:19
JetElements <= 2.9.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.9.2.4
CVE-2026-111414
6.4
Medium
nh4tvdYes
2026-10-12 08:59
JetElements <= 2.9.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.9.2.3
CVE-2026-107866
6.4
Medium
nh4tvdYes
2026-10-06 08:08
JetElements <= 2.9.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.9.2.2
CVE-2026-105879
6.4
Medium
nh4tvdYes
2026-09-17 11:52
JetElements <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.9.2.1
CVE-2026-66579
6.4
Medium
nh4tvdYes
2026-07-22 00:00
JetElements <= 2.9.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.9.1.1
CVE-2026-65465
6.4
Medium
Ananda DhakalYes
2025-12-30 05:20
JetElements For Elementor <= 2.7.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.7.12.2
CVE-2026-24958
6.4
Medium
BondsYes
2025-11-06 00:00
JetElements For Elementor <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.7.12
CVE-2025-64355
6.4
Medium
BondsYes
2025-08-14 00:00
JetElements For Elementor <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.7.9
CVE-2025-55714
6.4
Medium
stealthcopterYes
2025-08-03 00:00
JetElements For Elementor <= 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
<= 2.7.8
CVE-2025-49939
6.4
Medium
stealthcopterYes
Showing 1–10 of 22 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C