CVE-2025-39448 is a stored cross-site scripting vulnerability in Crocoblock JetElements For Elementor (<= 2.7.4.1) caused by improper input neutralization during web page generation. This flaw allows attackers with low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability of affected systems. The vulnerability has a CVSS 3.1 score of 6.5, reflecting medium severity. There is no vendor advisory or patch information available at this time, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, data manipulation, or disruption of service. The CVSS vector indicates network attack vector with low complexity and low privileges required, but user interaction is necessary. The impact affects confidentiality, integrity, and availability at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Crocoblock's official channels for updates. Until a patch is available, consider limiting user privileges and exercising caution with user-generated content in JetElements For Elementor. No vendor advisory states that no action is required or that the issue is mitigated.