Is jetwidgets-for-elementor (WordPress plugin) vulnerable?

WordPress jetwidgets-for-elementor has 7 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.

7advisories
0critical
0on CISA KEV
2no fix recorded
CVETitleSeverityCVSSAffectedFixed in
CVE-2021-24268The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) bymedium5.4<1.0.91.0.9
CVE-2023-0034The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting medium5.4<=1.0.13–
CVE-2024-2138The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions umedium6.4<1.0.161.0.16
CVE-2023-0086The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. Thismedium5.4<=1.0.12–
CVE-2024-2507The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up medium6.4<1.0.171.0.17
CVE-2024-10323The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versionsmedium6.4<1.0.191.0.19
CVE-2024-4626The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in medium6.4<1.0.181.0.18

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs   How findings are ranked
A version is vulnerable when it falls inside an affected range and below the fixed version. phpwarden applies these ranges to the exact versions in your lockfile or install, so you only see what applies to you.