EUVD-2026-42861
GHSA-p2f7-frf4-85gc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects required Contributor account; UI:R corrects the official vector since a victim must visit the page for stored XSS to execute; S:C applies as the script runs in other users' browser sessions.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Jeg Kit for Elementor - Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget's 'sg_body_description' parameter in versions up to, and including, 3.2.6. This is due to insufficient input sanitization and output escaping on the description attribute in the render_body() method of the Image_Box_View class - every other attribute used by the method is wrapped in esc_attr(), but the description value is concatenated directly into HTML body context. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in Jeg Elementor Kit for WordPress versions through 3.2.6 enables authenticated Contributors to inject persistent malicious scripts via the Image Box widget's description field. The root cause is a deliberate inconsistency in the render_body() method of Image_Box_View: every other attribute is sanitized with esc_attr(), but sg_body_description is concatenated raw into HTML body context. Any user who visits a page containing the injected widget executes the payload, enabling session hijacking and potential escalation to Administrator. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability exists within the jeg-elementor-kit WordPress plugin, an addon for the Elementor page builder. The Image_Box_View class contains a render_body() method that renders multiple widget attributes into HTML. Source code at both tags/3.1.1 (lines 27, 58, 72) and tags/3.2.6 (same lines) confirms that all attribute outputs except sg_body_description are wrapped in WordPress's esc_attr() function, which HTML-encodes special characters to prevent injection. The description value bypasses this and is concatenated directly into HTML body context without encoding, creating a persistent XSS sink. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this class of flaw precisely: user-controlled data reflected or stored in an HTML response without context-appropriate output encoding. Because the value lands in HTML body context rather than an attribute context, esc_html() rather than esc_attr() would be the correct WordPress function, but neither is applied.
RemediationAI
Update the Jeg Elementor Kit plugin to the latest available version beyond 3.2.6 as soon as possible. A fix is confirmed via WordPress plugin repository changeset 3596439 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3596439%40jeg-elementor-kit&new=3596439%40jeg-elementor-kit), which addresses the missing output escaping; however, the exact version number of the released patched build was not confirmed in the available data and should be verified in the WordPress plugin dashboard or at the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/be78b7d5-3f99-46de-b2b8-14254ee1ab71) before deploying. As a compensating control pending the update, restrict Contributor role assignment to fully trusted users only, or use a capability management plugin to prevent Contributors from editing Elementor layouts. Note that restricting role assignment does not remediate the flaw - it only limits the pool of principals who can exploit it.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today