CVE-2026-11380: JetWidgets For Elementor Stored XSS in Animated Box Widget

Technical summary

CVE-2026-11380 is a Stored Cross-Site Scripting (XSS) vulnerability in JetWidgets For Elementor up to version 1.0.21. The Animated Box widget fails to properly escape the animation_effect parameter before rendering it into an HTML class attribute. While the plugin does accept input from authenticated users, it does not validate or sanitize the animation_effect setting on the server side before output. This allows an attacker with author-level or higher WordPress permissions to inject arbitrary JavaScript that persists in the database and executes for all site visitors. The vulnerability is classified under CWE-79 (Cross-site Scripting).

Business impact

If exploited, this vulnerability enables attackers with WordPress author access to compromise the integrity and confidentiality of your website. Injected scripts can steal visitor session tokens, harvest credentials, redirect users to malicious sites, deface content, or perform actions on behalf of visitors. For organizations running multi-author WordPress sites with contractors, editors, or agency partners, the risk is elevated because each author-level user becomes a potential attack vector. Stored XSS is particularly dangerous because the payload persists and affects all visitors until removed.

Affected systems

JetWidgets For Elementor plugin versions up to and including 1.0.21 are affected. The vulnerability exists in the Animated Box widget component. Any WordPress installation running this plugin at a vulnerable version is at risk, provided that users with author-level or administrator roles exist on the site.

Exploitability

The vulnerability requires authentication and author-level or higher privileges on the WordPress site. An attacker cannot exploit this vulnerability from the internet without valid WordPress credentials and sufficient role permissions. However, for organizations with multiple authors, contractors, or agency access, the pool of potential attackers is wider than a typical unauthenticated flaw. Once credentials are obtained or misused, exploitation is straightforward: an attacker simply creates or edits a page using the Animated Box widget and injects script code into the animation_effect field. No special tools or complex interaction are needed. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update JetWidgets For Elementor to a version newer than 1.0.21 that includes a fix for insufficient output escaping and server-side validation. Verify the patch version against the official plugin repository or vendor advisory before deployment. Additionally, audit user roles and revoke author-level access for users who no longer require it. Review recent page edits and Animated Box widget usage for suspicious activity.

Patch guidance

Check the JetWidgets For Elementor plugin repository or the vendor's website for an available patch release numbered higher than 1.0.21. Update through the WordPress plugin management interface once a patched version is confirmed available. After updating, verify the plugin version in WordPress Admin > Plugins and confirm the update completed successfully. Test your site's functionality, especially pages using the Animated Box widget, to ensure the update did not break existing configurations.

Detection guidance

Look for Animated Box widget instances with unusual animation_effect values that contain HTML or JavaScript-like syntax (e.g., strings with angle brackets, event handlers, or script tags). Check WordPress post and postmeta database tables for suspicious entries in the JetWidgets Animated Box widget settings. Monitor browser console errors on affected pages that might indicate XSS injection attempts. Enable WordPress security plugins that scan for stored XSS patterns or use Web Application Firewall (WAF) rules to block payloads in POST requests to wp-admin pages. Review user audit logs to identify which authors have edited pages with the Animated Box widget recently.

Why prioritize this

This vulnerability merits timely but not emergency-level action. It carries a CVSS 3.1 score of 6.4 (MEDIUM severity) because exploitation requires authentication and author-level privileges, limiting the attack surface compared to unauthenticated flaws. However, the impact is significant: stored XSS can compromise all site visitors and data. Organizations with tightly controlled author lists can deprioritize slightly; those with many external contributors or agencies should prioritize higher. The vulnerability is not on the KEV list, so there is no active exploitation intelligence yet, but that does not eliminate the risk.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects the balance between impact and attack difficulty. The attack vector is network-based (AV:N) and requires low complexity (AC:L), but crucially requires prior authentication (PR:L). The scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component, consistent with XSS affecting other users. The confidentiality and integrity impacts are rated as low (C:L, I:L) because JavaScript execution is confined to the browser and typical web context, not full system compromise. Availability is not impacted (A:N). Organizations should not dismiss a MEDIUM score; stored XSS is a serious flaw that demands a timely fix.

Frequently asked questions