GCVE - cpe:2.3:a:crocoblock:jetelements:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:crocoblock:jetelements:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Crocoblock (`ef7ce6af-89c8-5e74-9d86-961d95db36f9`)
Product	Jetelements (`a99f9792-e0cb-51ab-8604-1f3478f6bfa9`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-0371`	vulnerable	2026-06-08 07:02:24.475420	Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets MEDIUM (6.4) The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2025-01-21T08:21:51.697Z Updated: 2026-04-08T17:28:25.374Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/ded2f366-375c-4cf6-9cbd-c969a3b3d6d5?source=cve https://crocoblock.com/changelog/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7291`	vulnerable	2026-06-08 06:58:21.747935	JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation HIGH (7.2) The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites. Published: 2024-08-03T06:41:39.862Z Updated: 2026-04-08T16:35:16.857Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8ea1c2-7c6e-43b3-97ca-a06438d51d11?source=cve https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/types/register-user.php#L220 https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/methods/update-user/user-meta-property.php#L23	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7145`	vulnerable	2026-06-08 06:58:21.361658	JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion HIGH (8.8) The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Published: 2024-08-16T13:48:56.036Z Updated: 2026-04-08T17:02:08.502Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/793f27ec-a3bb-4273-a41c-cc5b04c8e8fc?source=cve https://crocoblock.com/plugins/jetelements/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7144`	vulnerable	2026-06-08 06:58:21.361221	JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting MEDIUM (6.4) The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-08-16T13:48:56.685Z Updated: 2026-04-08T17:21:02.844Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e64adf-49b3-4e85-8dc1-918f7e92965b?source=cve https://crocoblock.com/plugins/jetelements/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-48761`	vulnerable	2026-06-08 06:14:28.014478	WordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerability MEDIUM (6.3) Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. Published: 2024-06-19T10:20:17.368Z Updated: 2026-04-28T16:08:54.940Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-48760`	vulnerable	2026-06-08 06:14:28.013894	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-48759`	vulnerable	2026-06-08 06:14:28.013171	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-39157`	vulnerable	2026-06-08 06:09:35.832025	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.