CVE-2026-105879

Executive Summary

CVE-2026-105879 is a stored cross-site scripting (XSS) vulnerability in the Crocoblock JetElements For Elementor WordPress plugin, affecting all versions up to and including 2.9.2.2. The flaw resides in improper neutralization of user-supplied input during web page generation (CWE-79), allowing an authenticated attacker with low privileges to inject persistent script content that executes in the browsers of other site users. With a CVSS v3.1 base score of 6.5, successful exploitation requires user interaction but can lead to session hijacking, credential theft, and compromise of site visitors and administrators.

Technical Analysis

JetElements For Elementor is a WordPress page-builder add-on that extends the Elementor editor with additional widget and module types. According to the NVD description, the vulnerability is classified as "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" — CWE-79 — and is specifically a stored (persistent) XSS variant.

The core mechanism of stored XSS is that attacker-controlled input is persisted by the application (for example in the WordPress database) and later rendered into HTML of a page without adequate output encoding or sanitization. The CVSS vector provides the key structural facts about this instance:

• AV:N (Network) — the attack surface is exposed over the network, consistent with a web-facing WordPress site running the plugin.
• AC:L (Low) — no special preconditions or race conditions are required; a single crafted submission suffices.
• PR:L (Low) — the attacker must possess low-level authenticated privileges. Within WordPress this maps to a contributor/author-level account or any role that can interact with plugin features and store the malicious input.
• UI:R (Required) — the victim must view the affected page/component for the payload to execute. This is typical of stored XSS, where the malicious content persists and fires when a privileged user (e.g., an administrator or editor) opens the crafted page or preview.
• S:C (Changed) — the browser's security context is considered changed: script executed in the victim's session originates from a lower-privileged injection path, and the attack crosses the privilege boundary between the injecting user and the viewing user.
• C:L / I:L / A:L — limited confidentiality, integrity, and availability impact.

Because the description does not disclose the specific parameter, widget, field, or endpoint involved, no implementation-level detail such as function names, request paths, or parameter identifiers can be asserted. What is unambiguous from the CNA-supplied data is the vulnerability class: input accepted from an authenticated low-privileged user is stored and then emitted into generated web pages without neutralization, enabling persistent JavaScript execution in the context of any viewer of that content.

The affected scope is explicitly "from n/a through 2.9.2.2" — i.e., all releases up to and including 2.9.2.2. With no patch evidence from any tracked source (patch confidence 0/4), the current distribution remains vulnerable.

Exploitation Scenarios

The description does not provide concrete identifiers (function names, endpoints, parameters, or file paths), so the following attack chain is described strictly at the vulnerability-class level; no specific code patterns are fabricated. No public proof-of-concept, Nuclei template, or exploit code exists for this CVE.

1. Reconnaissance / Target Identification. The attacker identifies WordPress sites that expose Elementor alongside the JetElements For Elementor plugin, for instance via plugin asset paths, page-builder markup, or public technologies in HTTP responses. A candidate must allow the attacker to hold a low-privileged authenticated account (PR:L). Any site using a vulnerable version (<= 2.9.2.2) with an attack surface reachable by such an account is in scope.

2. Triggering the Flaw Class. Leveraging low-privileged authenticated access, the attacker submits crafted input into a plugin-supplied content field that is subsequently persisted by the application. Because the vulnerability is improper neutralization during web page generation, the unsanitized/unencoded input is stored server-side and later emitted into generated HTML. No specific parameter name is asserted here because the advisory does not disclose one.

3. Payload / Execution Method. At the vulnerability-class level, the stored payload consists of browser-interpretable script content that is rendered verbatim within a generated page. Execution occurs when a subsequent user — typically a higher-privileged one such as an editor or administrator — views the page, preview, or list view containing the stored content, satisfying the UI:R precondition. The S:C rating indicates the script runs in a context not equivalent to the attacker's original privilege level.

4. Post-Exploitation Impact. Consistent with the C:L/I:L/A:L vector, an attacker can, at the class level, act in the victim's authenticated browser session context: reading or exfiltrating page content and tokens exposed to the DOM, performing actions on behalf of the victim, and modifying rendered content. In WordPress, XSS firing in an administrator's session is valuable because it can enable privilege escalation and full site takeover — but note the specific exploitation mechanics beyond the generic XSS class are not documented for this CVE and are therefore not asserted as confirmed capabilities.

Impact Assessment

Successful exploitation yields persistent script execution in the browsers of users who view attacker-influenced content. The CVSS v3.1 base score is 6.5 (MEDIUM), derived from AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.

• Confidentiality (Low): potential disclosure of session data, tokens, or rendered content accessible to the victim's session.
• Integrity (Low): the attacker may alter content or actions performed in the victim's session.
• Availability (Low): limited, non-persistent degradation rather than denial of service.
• Scope (Changed): the security authority of the vulnerable component is exceeded because script runs with the viewing user's session authority, crossing a privilege boundary.

Blast radius: any WordPress deployment running JetElements For Elementor up to and including 2.9.2.2 with an enabled low-privileged account surface. The most severe consequence is typical of stored XSS in CMS add-ons: an administrator or editor who views the stored content executes the payload, and impact escalates toward full site compromise. Because the flaw is unpatched, exposure persists until mitigation is applied. There is no evidence of active exploitation, CISA KEV listing, or public exploit availability; EPSS is not yet scored by FIRST.org, so probabilistic exploitation likelihood should not be inferred.

Detection Guidance

Sigma Rule

title: Potential Stored XSS Payload Submitted to JetElements For Elementor
id: 8f3c2a51-7b4e-4a2d-9c11-jetelen105879
status: experimental
description: Detects common XSS payload markers in HTTP request bodies directed at WordPress sites running the JetElements For Elementor plugin (CVE-2026-105879). Tuning required.
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_path:
    cs-uri-query|contains:
      - '/wp-admin/'
      - 'admin-ajax.php'
      - 'elementor'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'document.cookie'
      - '<img src=x'
  condition: selection_path and selection_payload
falsepositives:
  - Legitimate rich content containing '<script' in demos/tests
level: medium
tags:
  - attack.t1059.007
  - cve.2026.105879

YARA Rule

rule CVE_2026_105879_JetElements_Stored_XSS
{
    meta:
        description = "Detects stored XSS payload markers in request/response artifacts targeting JetElements For Elementor (CVE-2026-105879)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105879"
        severity = "medium"

    strings:
        $plugin = "jet-elements" ascii nocase
        $e1 = "<script" ascii nocase
        $e2 = "onerror=" ascii nocase
        $e3 = "onload=" ascii nocase
        $e4 = "javascript:" ascii nocase
        $e5 = "document.cookie" ascii nocase
        $e6 = "String.fromCharCode(" ascii nocase

    condition:
        $plugin and 1 of ($e*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105879 JetElements For Elementor Stored XSS Payload Attempt"; flow:established,to_server; http.method; content:"GET"; content:"jet-elements"; http.uri; nocase; content:"<script"; http.client_body; nocase; content:"onerror="; http.client_body; nocase; sid:2026105879; rev:1; reference:cve,2026-105879; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105879; classtype:web-application-attack; metadata:service http;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST"
      and http.request.body.text contains "<script"
      and url.path contains "admin-ajax.php" ]
  [ network where http.request.method == "GET"
      and url.path contains "elementor"
      and http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval payload=lower(uri_query." ".form_data)
| where (payload like "%<script%" OR payload like "%onerror=%" OR payload like "%onload=%" OR payload like "%document.cookie%" OR payload like "%javascript:%")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, host
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-105879,">
  <rule id="2026105879" level="10">
    <if_sid>31100</if_sid>
    <regex>jet-elements|elementor|admin-ajax\.php</regex>
    <regex>&lt;script|onerror=|onload=|javascript:|document\.cookie</regex>
    <description>CVE-2026-105879: Potential Stored XSS payload submitted to JetElements For Elementor</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_105879,xss,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch source, vendor fix, or workaround is available from the tracked intelligence sources for CVE-2026-105879.

1. Immediate Mitigations (compensating controls, since no patch exists):

   • Enforce least privilege: audit and reduce accounts holding contributor/author-level privileges that can store content; remove unnecessary accounts.
   • Apply a web application firewall (WAF) or reverse-proxy content filtering with XSS-oriented rules to inspect and block script-bearing input in request bodies.
   • Enable a WordPress security plugin with server-side input sanitization/HTML filtering on stored content where feasible.
   • Consider temporarily disabling the JetElements For Elementor plugin if it is not business-critical, until a fixed version is released.
   • Harden cookies (HttpOnly, Secure, SameSite) to reduce the value of session theft via XSS.

2. Patch / Upgrade Steps:

   • No fixed version is known. Monitor the Crocoblock vendor channels and the WordPress plugin repository for a release beyond 2.9.2.2 and upgrade immediately when available.
   • Until then, treat all installs at or below 2.9.2.2 as vulnerable and maintain the compensating controls above.
   • Subscribe to NVD (CVE-2026-105879) and vendor advisories for patch notification.

3. Long-term Hardening:

   • Adopt a vulnerability management workflow that tracks WordPress plugin CVEs and enforces timely updates.
   • Enforce strict role-based access control and review user permissions regularly.
   • Deploy layered defenses: WAF, CSP (Content-Security-Policy) headers to mitigate script execution, and output-encoding validation in custom code.
   • Maintain monitoring and alerting for stored-content anomalies and untrusted script markers.

References

• NVD — CVE-2026-105879: https://nvd.nist.gov/vuln/detail/CVE-2026-105879
• CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• Crocoblock JetElements For Elementor (vendor product page / changelog): https://crocoblock.com/plugins/jetelements/
• WordPress Plugin Security guidance / WAF XSS protections: https://wordpress.org/plugins/
• MITRE ATT&CK T1059.007, Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/

Threat actor campaigns: none identified in the provided intelligence. Exploit-in-the-wild evidence: none identified. CISA KEV: not listed. EPSS: not yet scored by FIRST.org.