Jeg Kit for Elementor CVE-2026-100180

Exploitation targets the plugin's comment submission feature. The sanitization/output-escaping bypass stems from a widened allowlist in the plugin (referenced in helper.php and framework-helper.php) and, per the description, works regardless of comment approval status. The key limiting factor is that immediate persistence WITHOUT moderator approval requires the attacker to submit from an email address that already has at least one previously approved comment on the site; otherwise the comment enters the normal moderation queue. Additional limiters: payload execution depends on a legitimate user (ideally an administrator) later browsing the injected page, and the High attack complexity (AC:H) reflects the approved-email precondition. Affects all versions up to and including 3.2.19 of Jeg Kit for Elementor.

This is a medium-severity (CVSS 5.4) stored XSS in a WordPress Elementor add-on, and the signals point to moderate - not urgent - priority. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N shows a network-reachable, unauthenticated (PR:N) flaw with changed scope (stored payload executes against other users), but the High attack complexity (AC:H) and limited C:L/I:L impact temper it. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code was supplied, so this is 'no public exploit identified at time of analysis' - do not treat it as actively exploited. The AC:H rating is consistent with the described precondition: immediate, moderation-free persistence requires submitting from an email that already has an approved comment. Note a nuance to verify with the vendor: the description states the 'widened allowlist bypasses sanitization regardless of approval status,' which suggests the sanitization bypass itself is unconditional even though unmoderated persistence is conditional - this partial conflict with the AC:H rating is worth confirming. Overall: a real but not critical issue, typical of stored XSS in a widely-used plugin; patch in routine cycles rather than emergency.

An unauthenticated attacker submits a comment containing a crafted script payload through the plugin's comment feature, exploiting insufficient input sanitization and output escaping. If the attacker uses an email address tied to at least one previously approved comment, the malicious comment persists immediately without moderator review; the injected script then executes in the browser of any user - including administrators - who views the affected page. No public proof-of-concept was provided in the input.