The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions…

JetWidgets For Elementor is a free widget pack for the Elementor page builder on WordPress. Versions up to and including 1.0.21 fail to properly sanitize and/or escape one or more widget attributes before rendering them, allowing a user with Contributor privileges or higher to inject arbitrary JavaScript that executes in the browser of any visitor who later loads the affected page. This is a classic stored XSS via authenticated post/widget input — the plugin trusts what an editorial user types into a shortcode/widget attribute and echoes it back into the DOM.

The vendor's 6.4 MEDIUM rating is accurate. CVSS scope-change (S:C) reflects that the payload runs in the site visitor's browser context, not the plugin's, and PR:L correctly captures the Contributor requirement. This is not a preauth site takeover — but it is also not zero. On a multi-author blog or membership site where Contributor is a self-service role, this is a real path to session theft against editors and admins.

Why this verdict

• Auth barrier holds: Contributor is not open-registration on the majority of production WordPress sites; the attacker must already have editorial access or a stolen credential.
• Blast radius is per-site, not fleet: stored XSS in a page-builder widget compromises one WordPress site's admin session at worst — no lateral movement, no supply-chain pivot, no cross-tenant impact.
• Role multiplier: N/A — JetWidgets is a presentation-layer Elementor add-on. It is not on the identity/hypervisor/backup/edge/CI catalog. There is no plausible deployment where the same bug ends in domain takeover or fleet compromise, so the role-floor rule does not raise the verdict.
• No KEV, no PoC, no campaigns — EPSS will land low; opportunistic mass exploitation is unlikely because the auth gate defeats spray-and-pray.
• Real-world friction: WAFs (Wordfence, Sucuri, Cloudflare) already block naive <script> injection in POST bodies; reasonable admin hygiene (don't preview untrusted drafts in a session with install_plugins) further shrinks the window.

Why not higher?

It's not HIGH because a Contributor account is a real gate on most production sites, the impact is scoped to one site's admin session, and there is no path to server-side code execution without a second bug. HIGH would require either unauthenticated reachability or a role-multiplier deployment — neither applies to an Elementor widget pack.

Why not lower?

It's not LOW because stored XSS in a widely-installed plugin (~100k installs) that specifically targets editorial staff — the people with install_plugins — is a credible path to full site takeover on multi-author blogs, membership sites, and agency-hosted WordPress. The vendor's 6.4 MEDIUM captures that correctly.

1. Update JetWidgets For Elementor to 1.0.22 or later — Vendor patch is the clean fix. For MEDIUM verdicts there is no noisgate mitigation SLA — schedule this into your standard WordPress plugin update window and complete within the noisgate remediation SLA of 365 days. If you run managed hosting with auto-updates enabled, verify it lands within the next cycle.
2. Audit and restrict Contributor+ role assignment — Confirm that open registration does not grant Contributor, Author, or Editor by default. Set default_role to subscriber in wp_options. Review existing Contributor accounts for staleness. This shrinks the reachable population for every authenticated WP plugin bug, not just this one.
3. Deploy or tune a WordPress WAF virtual patch — Wordfence, Patchstack, and Sucuri will publish rule signatures for CVE-2026-11380 within days. Enable the rule feed and ensure it applies to /wp-admin/admin-ajax.php and REST endpoints. Buys coverage until the plugin update ships across your estate.
4. Enforce a Content-Security-Policy on the WP frontend and admin — A CSP with script-src 'self' 'nonce-…' neutralizes inline stored XSS payloads even when the sink exists. Use a plugin like WP Content Security Policy or edge headers at Cloudflare. This is a structural defense against the entire class.
5. Instruct editors/admins not to preview untrusted contributor drafts in a privileged session — Use a separate browser profile or an incognito window without WP auth cookies to review submissions. Removes step 4 of the attack path entirely.

Run this on any Linux host with SSH access to your WordPress webroot(s), or wrap it in your config-management inventory to sweep the fleet. Invoke as ./check-cve-2026-11380.sh /var/www/html where the argument is the WordPress install root. No elevated privileges required beyond read access to wp-content/plugins/.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-11380 — JetWidgets For Elementor stored XSS
# Usage: ./check-cve-2026-11380.sh /path/to/wordpress
set -u

WP_ROOT="${1:-/var/www/html}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/jet-widgets-for-elementor"
FIXED_VERSION="1.0.22"

if [ ! -d "$WP_ROOT/wp-content/plugins" ]; then
  echo "UNKNOWN: $WP_ROOT does not look like a WordPress install"
  exit 2
fi

if [ ! -d "$PLUGIN_DIR" ]; then
  # Try alternate slug (some Crocoblock releases used jet-widgets)
  PLUGIN_DIR="$WP_ROOT/wp-content/plugins/jet-widgets"
fi

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "PATCHED: JetWidgets For Elementor not installed at $WP_ROOT"
  exit 0
fi

# Extract version from the plugin header
HEADER_FILE=$(grep -rlE '^[[:space:]]*Plugin Name:.*Jet[[:space:]]*Widgets' "$PLUGIN_DIR" 2>/dev/null | head -n1)
if [ -z "$HEADER_FILE" ]; then
  echo "UNKNOWN: could not locate plugin header in $PLUGIN_DIR"
  exit 2
fi

INSTALLED=$(grep -iE '^[[:space:]]*\*?[[:space:]]*Version:' "$HEADER_FILE" | head -n1 | sed -E 's/.*Version:[[:space:]]*([0-9.]+).*/\1/')
if [ -z "$INSTALLED" ]; then
  echo "UNKNOWN: could not parse plugin version"
  exit 2
fi

# Semver compare: return 0 if $1 < $2
ver_lt() { [ "$1" = "$2" ] && return 1; [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]; }

if ver_lt "$INSTALLED" "$FIXED_VERSION"; then
  echo "VULNERABLE: JetWidgets For Elementor $INSTALLED at $PLUGIN_DIR (fixed in $FIXED_VERSION)"
  exit 1
else
  echo "PATCHED: JetWidgets For Elementor $INSTALLED at $PLUGIN_DIR (>= $FIXED_VERSION)"
  exit 0
fi

Sources

1. Wordfence Threat Intelligence — CVE-2026-11380
2. Patchstack database — JetWidgets For Elementor
3. WordPress.org plugin page — JetWidgets For Elementor
4. Crocoblock changelog
5. NVD — CVE-2026-11380
6. CWE-79: Improper Neutralization of Input During Web Page Generation (XSS)
7. OWASP — Stored XSS
8. CISA KEV catalog