{"repro_id":"REPRO-2026-00203","version":8,"title":"JetWidgets For Elementor Stored XSS via Animated Box animation_effect","repro_type":"security","status":"published","severity":"medium","description":"The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due to insufficient output escaping and missing server-side validation of the Animated Box widget's animation_effect setting before it is rendered inside an HTML class attribute. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","root_cause":"# RCA Report: CVE-2026-11380 — JetWidgets For Elementor Stored XSS\n\n## Summary\n\nThe JetWidgets For Elementor WordPress plugin (versions up to and including 1.0.21) is vulnerable to a stored cross-site scripting (Stored XSS) flaw in the Animated Box widget. The widget's `animation_effect` setting is printed directly into the HTML `class` attribute of the rendered widget without output escaping or server-side validation. An attacker who can supply a value containing a double quote can break out of the `class` attribute and inject arbitrary attributes, including event handlers such as `onmouseover=\"alert(1)\"`. Because the payload is stored in the page and rendered whenever anyone visits the page, this is a stored XSS issue. The reproduction confirmed the payload in the published page HTML by deploying a real WordPress + Elementor + JetWidgets stack and viewing the rendered page.\n\n## Impact\n\n- **Product / component:** `jetwidgets-for-elementor` (Crocoblock / jetmonsters) — specifically the `jw-animated-box` widget.\n- **Affected versions:** 1.0.21 and earlier (the WordPress.org repository still lists 1.0.21 as the current stable release at the time of the CVE).\n- **Risk level:** Medium. The vendor/Wordfence CVSS is reported as 6.4.\n- **Consequences:** Any authenticated user with at least the `author` role can save a page containing a malicious Animated Box widget. The injected JavaScript is stored in the page and executes in the browser of any visitor who views the page.\n\n## Impact Parity\n\n- **Disclosed / claimed maximum impact:** Stored XSS via an author-level account in the Animated Box widget's `animation_effect` setting.\n- **Reproduced impact from this run:** A real WordPress environment was deployed with Elementor and JetWidgets 1.0.21. A published page was created with a malicious `animation_effect` value. The rendered page HTML contains the escaped attribute boundary break and the injected `style` and `onmouseover=\"alert(1)\"` attributes.\n- **Parity:** `full` — the reproduction reaches the same rendered-page sink described in the advisory.\n- **Not demonstrated:** The reproduction does not run a full browser engine, so the JavaScript payload itself is not executed in the test environment. The proof relies on the presence of the injected event handler in the server-rendered HTML, which is the root cause of the stored XSS.\n\n## Root Cause\n\nThe vulnerability is in the widget's render template:\n\n```php\n\n
__html( 'animation_effect', '%s' ); ?>\">\n```\n\nThe helper method chain ends up in `includes/base/class-jet-widgets-base.php`:\n\n```php\npublic function __render_html( $setting = null, $format = '%s' ) {\n ...\n printf( wp_kses_post( $format ), $val );\n}\n```\n\n`wp_kses_post()` is applied to the format string `'%s'`, not to the value. Therefore the raw `animation_effect` value is printed verbatim inside the HTML `class` attribute. The UI control in `includes/addons/jet-widgets-animated-box.php` is a `