CVE-2026-24958: 
WordPress vulnerability analysis and mitigation

CVE-2026-24958 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Crocoblock JetElements For Elementor WordPress plugin. It affects all versions up to and including 2.7.12.2, with version 2.7.12.3 being the patched release. The vulnerability was reported on November 30, 2025, by researcher "Bonds" via Patchstack's Active VDP program, and published on December 30, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. Exploitation requires a low-privileged authenticated user (Contributor or Developer role) to craft a malicious payload that is processed and rendered in the victim's browser DOM without proper sanitization or escaping. Successful exploitation also requires user interaction — a privileged user must perform an action such as visiting a crafted page or clicking a malicious link (Patchstack).

Successful exploitation allows an attacker to inject and execute malicious JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and injection of malicious redirects or advertisements visible to site visitors. The confidentiality, integrity, and availability impacts are each rated Low, with a changed scope indicating the attack can affect resources beyond the vulnerable component (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack). It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running JetElements For Elementor plugin version 2.7.12.2 or earlier using tools like WPScan or Shodan.
2. Obtain low-privileged access: Register or obtain a Contributor or Developer account on the target WordPress site.
3. Craft malicious payload: Create a page or post using the JetElements Elementor widget that includes a DOM-Based XSS payload (e.g., injecting a malicious JavaScript snippet into a vulnerable widget parameter that is rendered without sanitization).
4. Deliver to victim: Share the crafted page URL with a higher-privileged user (e.g., Administrator) via phishing or social engineering to trigger the payload when they visit or preview the content.
5. Execute payload: When the victim's browser renders the page, the injected script executes in their browser context, enabling session token theft, credential harvesting, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to Elementor-related endpoints containing encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload= patterns in URL or body parameters.
• File System: Unexpected modifications to WordPress theme files, plugin files, or the addition of new PHP/JS files in the JetElements plugin directory (/wp-content/plugins/jet-elements/).
• Network: Outbound requests from the WordPress server to unknown external domains, potentially indicating data exfiltration triggered by an XSS payload.
• Browser/Application: Victim users reporting unexpected redirects, pop-ups, or unauthorized actions performed on the WordPress admin dashboard after visiting specific pages.

The vendor Crocoblock has released version 2.7.12.3 of JetElements For Elementor, which patches this vulnerability. Site administrators should update the plugin to version 2.7.12.3 or later immediately. If an immediate update is not possible, restrict Contributor-level user registration and review existing Contributor/Developer accounts for suspicious activity. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).