¿Es seguro JetElements For Elementor?

Qué hace este plugin

• Slug: jet-elements
• Autor: Seraphinite Solutions
• 50000+ instalaciones activas
• 96/100 calificación (475 reseñas en wordpress.org)
• 881996 descargas totales
• En WordPress.org desde 2021-05-29

cacheOptimizepagespeedperformancespeed up

Estado de mantenimiento

• Última actualización: 2026-07-23 8:25am GMT
• Probado hasta WordPress: 7.0.2
• Requiere PHP: 7.1+

Vulnerabilidades conocidas

16 CVEs conocidos registrados para JetElements For Elementor.

CVE-2026-24958

The JetElements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.12.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-64355

The JetElements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-55714

The JetElements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-49939

The JetElements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-53982

The JetElements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-53983

The JetElements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-39448

The JetElements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-39447

The JetElements plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.7.4.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 8 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2024-7144	JetElements For Elementor [jet-elements] < 2.6.20.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 2.6.20.1	2.6.20.1	2024-08-15	—
CVE-2024-7145	JetElements For Elementor [jet-elements] < 2.6.20.1	Limitación incorrecta de una ruta a un directorio restringido (Path Traversal)	Alta 8,8	< 2.6.20.1	2.6.20.1	2024-08-15	—
CVE-2023-48760	JetElements For Elementor [jet-elements] < 2.6.13.1	Falta de control de autorización	Alta 8,2	< 2.6.13.1	2.6.13.1	2023-11-28	—
CVE-2023-48761	JetElements For Elementor [jet-elements] < 2.6.13.1	Falta de control de autorización	Media 6,3	< 2.6.13.1	2.6.13.1	2023-11-28	—
CVE-2023-48762	JetElements For Elementor [jet-elements] < 2.6.13.1	Falsificación de petición en sitios cruzados (CSRF)	Media 6,3	< 2.6.13.1	2.6.13.1	2023-11-28	—
CVE-2023-48759	JetElements For Elementor [jet-elements] < 2.6.13.1	Falta de control de autorización	Alta 7,5	< 2.6.13.1	2.6.13.1	2023-11-28	—
CVE-2023-39157	JetElements For Elementor [jet-elements] < 2.6.11	Control incorrecto de la generación de código (inyección de código)	Crítica 9,0	< 2.6.11	2.6.11	2023-08-03	—
CVE-2025-0371	JetElements For Elementor [jet-elements] < 2.7.3	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 2.7.3	2.7.3	0000-00-00	—

CVE-2024-7144

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-7145

The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-48760

Update the WordPress JetElements For Elementor plugin to the latest available version (at least 2.6.13.1). Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress JetElements For Elementor Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 2.6.13.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-48761

Update the WordPress JetElements For Elementor plugin to the latest available version (at least 2.6.13.1). Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress JetElements For Elementor Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 2.6.13.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-48762

Update the WordPress JetElements For Elementor plugin to the latest available version (at least 2.6.13.1). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress JetElements For Elementor Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 2.6.13.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-48759

Update the WordPress JetElements For Elementor plugin to the latest available version (at least 2.6.13.1). Rafie Muhammad (Patchstack) discovered and reported this Arbitrary File Download vulnerability in WordPress JetElements For Elementor Plugin. This could allow a malicious actor to download any file from your website. This includes but is not limited to files that contain login credentials or backup files. This vulnerability has been fixed in version 2.6.13.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-39157

Update the WordPress JetElements For Elementor plugin to the latest available version (at least 2.6.11). Rafie Muhammad (Patchstack) discovered and reported this Remote Code Execution (RCE) vulnerability in WordPress JetElements For Elementor Plugin. This could allow a malicious actor to execute commands on the target website. This can be used to gain backdoor access to then take full control of the website. This vulnerability has been fixed in version 2.6.11.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2025-0371

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• LiteSpeed Cache — 7000000+ instalaciones activas — 96/100 (2760) — PHP máx. 8.4
• WP Super Cache — 1000000+ instalaciones activas — 86/100 (1343) — PHP máx. 8.4
• WP Fastest Cache – WordPress Cache Plugin — 1000000+ instalaciones activas — 98/100 (4220) — PHP máx. 8.4
• WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance — 1000000+ instalaciones activas — 96/100 (2599) — PHP máx. <8.0
• W3 Total Cache — 900000+ instalaciones activas — 88/100 (5420)