CVE-2026-11380

Name of the Vulnerable Software and Affected Versions JetWidgets For Elementor versions prior to 1.0.22

Description Stored Cross-Site Scripting occurs due to insufficient output escaping and missing server-side validation of the animation effect setting within the Animated Box widget before it is rendered inside an HTML class attribute. Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update JetWidgets For Elementor to version 1.0.22 or later. As a temporary mitigation, restrict access to the Animated Box widget for users with author-level permissions.