WordPress security by component

Jeg Elementor Kit

Plugin description

Jeg Elementor Kit provides Elementor widgets, templates, sections, and design elements for creating customized WordPress websites.

Jeg Elementor Kit (jeg-elementor-kit) is a WordPress plugin with 23 published CVE records in this archive. The latest tracked vulnerability was published Sep 18, 2026; the highest published CVSS base score is 8.6.

Plugin slug: jeg-elementor-kit

Latest vulnerability

CVE-2026-18405: Jeg Kit Countdown scripts activate attacker-supplied comment markup

Jeg Kit for Elementor through 3.2.16 permits unauthenticated stored XSS through comment content, but only when the targeted post also renders a legitimate Jeg Kit Countdown widget. That widget causes its frontend script to load and initialize matching DOM elements, including forged widget markup stored in comments. Attacker-controlled comment markup can therefore reach the widget's executable rendering path when the page is viewed. The export does not disclose the exact malicious attribute, initialization function, submission route, or whether comment approval is needed in a given configuration. It does not establish a moderation bypass. Although the CNA vector records UI:N, script execution still depends on a user viewing the affected content. No fixed version is confirmed.

PublishedSep 18, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for jeg-elementor-kit
		Safe version
Sep 18, 2026	CVE-2026-18405 Jeg Kit Countdown scripts activate attacker-supplied comment markup Jeg Kit for Elementor through 3.2.16 permits unauthenticated stored XSS through comment content, but only when the targeted post also renders a legitimate Jeg Kit Countdown widget. That widget causes its frontend script to load and initialize matching DOM elements, including forged widget markup stored in comments. Attacker-controlled comment markup can therefore reach the widget's executable rendering path when the page is viewed. The export does not disclose the exact malicious attribute, initialization function, submission route, or whether comment approval is needed in a given configuration. It does not establish a moderation bypass. Although the CNA vector records UI:N, script execution still depends on a user viewing the affected content. No fixed version is confirmed.	See mitigation notes	CVE7.2 NVDPending
Aug 06, 2026	CVE-2026-65549 Jeg Kit for Elementor permits Author-level PHP object injection A logged-in user with Author access can supply serialized data that reaches unsafe PHP object deserialization in Jeg Kit for Elementor 3.2.10 and earlier. Exploitation can invoke magic methods in available classes; final impact depends on a compatible gadget chain and may include application-state changes, file operations or code execution.	3.2.11	CVE7.2 NVDPending
Aug 01, 2026	CVE-2026-2916 Jeg Kit exposes configuration and possible API credentials to Contributors Jeg Kit for Elementor through 3.1.1 runs class/dashboard/class-dashboard.php::enqueue_scripts() on the post.php administration screen for users who can edit posts. It injects JkitDashboardOption into the page without an additional capability check, allowing a Contributor-or-higher user to inspect plugin names, versions, paths and activation states; WordPress, PHP, URL and server-capability details; and jkit_user_data values that may include a Mailchimp API key. The attacker reads the inline JavaScript from the page source after logging in.	3.1.2	CVE4.3 NVDPending
Jul 10, 2026	CVE-2026-13710 Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress: Cross-site scripting Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.2.6.	See mitigation notes	CVE6.4 NVDPending
May 02, 2026	CVE-2026-6916 Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress: Cross-site scripting Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.1.0.	See mitigation notes	CVE6.4 NVDPending
Jan 08, 2026	CVE-2025-14275 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVDPending
May 10, 2025	CVE-2025-2944 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVDPending
Feb 27, 2025	CVE-2024-13217 Jeg Elementor Kit: Sensitive information exposure Jeg Elementor Kit is affected by sensitive information exposure. Exploitation requires an authenticated contributor account. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE4.3 NVD4.3
Nov 26, 2024	CVE-2024-8899 Jeg Elementor Kit: Sensitive information exposure Jeg Elementor Kit is affected by sensitive information exposure. Exploitation requires an authenticated contributor account. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE4.3 NVDPending
Nov 26, 2024	CVE-2024-10308 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Oct 05, 2024	CVE-2024-47390 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVD5.4
Aug 27, 2024	CVE-2024-6804 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Jun 15, 2024	CVE-2024-4479 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
May 02, 2024	CVE-2024-3819 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
May 02, 2024	CVE-2024-3161 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
May 01, 2024	CVE-2024-0334 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Apr 24, 2024	CVE-2024-32721 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVD5.4
Apr 03, 2024	CVE-2024-3162 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Apr 03, 2024	CVE-2024-1327 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Mar 21, 2024	CVE-2024-1326 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Mar 19, 2024	CVE-2024-29101 Jeg Elementor Kit: Cross-site scripting Jeg Elementor Kit is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVD5.4
Dec 22, 2022	CVE-2022-3805 Jeg Elementor Kit: A security weakness Jeg Elementor Kit is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE8.6 NVD7.5
Dec 22, 2022	CVE-2022-3794 Jeg Elementor Kit: A security weakness Jeg Elementor Kit is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4 NVD4.3

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers