CVE-2026-65465— WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability
Possible ATT&CK Techniques 1AI
T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Crocoblock. Jetimpex Inc. | JetElements For Elementor | n/a≤ 2.9.1.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-65465
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Crocoblock JetBlocks For Elementor 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Crocoblock JetBlocks For Elementor是美国Crocoblock公司的一个为Elementor设计的区块插件。 Crocoblock JetBlocks For Elementor 2.9.1.1及之前版本存在跨站脚本漏洞，该漏洞源于跨站脚本（XSS）问题，可能导致贡献者用户利用网络访问，在用户交互下实现跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Crocoblock. Jetimpex Inc. | JetElements For Elementor | n/a ~ 2.9.1.1 | - |
II. Public POCs for CVE-2026-65465
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-65465
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-65465 (1)
Same Patch Batch · Crocoblock. Jetimpex Inc. · 2026-07-23 · 4 CVEs total
| CVE-2026-65468 | 5.3 MEDIUM | WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability |
| CVE-2026-65467 | 4.9 MEDIUM | WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability |
| CVE-2026-65466 | 4.9 MEDIUM | WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability |
IV. Related Vulnerabilities
Same product: JetElements For Elementor
- CVE-2026-24958
WordPress JetElements For Elementor plugin <= 2.7.12.2 - Cro - CVE-2025-64355
WordPress JetElements For Elementor plugin <= 2.7.12 - Cross - CVE-2025-49939
WordPress JetElements For Elementor plugin <= 2.7.8 - Cross - CVE-2025-53983
WordPress JetElements For Elementor <= 2.7.7 - Sensitive Dat - CVE-2025-55714
WordPress JetElements For Elementor Plugin <= 2.7.9 - Cross
Same vendor: Crocoblock. Jetimpex Inc.
- CVE-2026-65468
WordPress JetBooking plugin <= 4.1.2 - Broken Access Control - CVE-2026-65467
WordPress JetEngine plugin <= 3.8.11 - Server Side Request F - CVE-2026-65466
WordPress JetBooking plugin <= 4.1.2 - Server Side Request F - CVE-2026-57354
WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scriptin - CVE-2026-56068
WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulne
Same weakness: CWE-79
- CVE-2026-65448
WordPress Anti Spam and list cleaner – AcyChecker plugin <= - CVE-2026-65447
WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scri - CVE-2026-65446
WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting - CVE-2026-65443
WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting ( - CVE-2026-65441
WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XS
V. Comments for CVE-2026-65465
No comments yet