CVE-2025-49939 describes a stored cross-site scripting vulnerability in the Crocoblock JetElements For Elementor plugin, affecting versions up to 2.7.8. The issue is caused by improper input neutralization during web page generation, which can lead to malicious script injection. The vulnerability requires at least limited privileges and user interaction to exploit, with potential impacts on confidentiality, integrity, and availability rated as low to medium. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and scope changed.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to inject and execute malicious scripts in the context of other users, potentially leading to information disclosure, modification of content, or disruption of service. The impact is rated medium with partial loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is provided in the available data, users should monitor Crocoblock's official channels for updates. Until a fix is available, limit user privileges and avoid accepting untrusted input that could be rendered by the plugin. No vendor-stated mitigations or workarounds are currently documented.