CVE-2023-39157 WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)

What is CVE-2023-39157?

CVE-2023-39157 is a critical code injection vulnerability in Crocoblock JetElements For Elementor, published on 31 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.

Weakness: CWE-94

Which versions are affected by CVE-2023-39157?

It affects 1 product.

Products include Crocoblock Jetelements.

How do I fix CVE-2023-39157?

No fix has been published for CVE-2023-39157 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-39157 being exploited?

There is no known exploitation of CVE-2023-39157 in the wild and no public exploit code.

Other vulnerabilities in Crocoblock JetElements For Elementor

• CVE-2024-7145 JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion High 8.8
• CVE-2023-48760 WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerability High 8.2
• CVE-2023-48759 WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerability High 7.5
• CVE-2025-0371 Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Medium 6.4
• CVE-2024-7144 JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xqh4-7g56-wxh4.