EUVD-2026-82852
GHSA-9vc8-8x69-mwph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFind post with Countdown widget
-
DeliverySubmit comment with forged widget markup
-
ExploitComment stored and published
-
ExecutionCountdown script initializes on payload
-
ImpactScript executes in visitor/admin browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the specific targeted post or page also renders a legitimate Jeg Kit for Elementor Countdown widget - this causes the countdown frontend script to be enqueued and to initialize on any matching DOM element, including the forged widget markup an attacker embeds inside comment content. It additionally requires that comments are enabled and that the malicious comment is published (installations that hold unauthenticated/first-time comments for administrator moderation break the unauthenticated path). The payload fires only when a victim subsequently visits the injected page. Limiting factors: the Countdown-widget dependency means most pages are NOT exploitable, comment moderation can block publication, and impact is confined to client-side script execution (C:L/I:L, no availability impact). Affected: all versions up to and including 3.2.16; fixed in 3.2.17. |
| Impact | This is a moderate-severity stored XSS (CWE-79) with a vendor CVSS3.1 of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). No EPSS score, no CISA KEV listing, and no public exploit code are provided, so exploitation status is: no public exploit identified at time of analysis. The CVSS vector marks this unauthenticated (PR:N) because the injection vector is comment content, which is consistent with the description. However, the raw 7.2 overstates real-world risk: successful exploitation is conditionally gated - the targeted post must ALSO render a legitimate Jeg Kit Countdown widget so the countdown frontend script is enqueued and initializes against the attacker's forged widget markup stored in the comment. It further depends on WordPress comment moderation being lax enough that the malicious comment is published (many installs require admin approval for first-time/unauthenticated commenters). The S:C/C:L/I:L reflects typical stored-XSS impact (script runs in other users'/admins' browser sessions, limited confidentiality and integrity, no availability impact). No conflicting signals in the vector itself, but the description's compound precondition is not captured by AC:L, so the practical exploitability is lower than the score implies. Treat as a real but not urgent priority - a patch-management item rather than an emergency. |
| Exploit ScenarioDerived | An attacker submits a blog comment on a page that hosts a Jeg Kit Countdown widget, embedding forged countdown-widget markup laced with a malicious script payload. Once the comment is published, the plugin's countdown frontend JavaScript initializes on the attacker's DOM element and executes the injected script in the browser of every visitor - including logged-in administrators viewing the page. No public POC is identified, but the Wordfence advisory and the patched countdown-view source (changeset 3690125) confirm the mechanism. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Stored cross-site scripting in the Jeg Elementor Kit WordPress plugin (all versions up to and including 3.2.16) allows unauthenticated attackers to inject arbitrary JavaScript into comment content, which then executes in the browser of any user who later views the affected page. The attack is conditional rather than universal: the targeted post must also render a legitimate Jeg Kit Countdown widget, which causes the plugin's countdown frontend script to be enqueued and to initialize on any matching DOM element - including forged Countdown widget markup smuggled into a published comment - and comments must be enabled and the malicious comment published (sites that hold first-time comments for administrator moderation break the unauthenticated path). The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while our independent assessment scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N given the widget dependency, moderation gate, and victim-visit requirement; impact is confined to client-side script execution with no availability impact, and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade the Jeg Elementor Kit plugin to version 3.2.17 or later (the 3.2.16→3.2.17 changeset, which modifies class/elements/views/class-countdown-view.php, is documented at https://plugins.trac.wordpress.org/changeset?reponame=&new=3690125%40jeg-elementor-kit%2Ftags%2F3.2.17&old=3679095%40jeg-elementor-kit%2Ftags%2F3.2.16). Until upgrading is possible, the most effective compensating control is to gate comment publishing: enable WordPress comment moderation so no unauthenticated or first-time comment is published without review, which removes the injection primitive entirely at the cost of added editorial workload; on sites where comments are not essential, disabling comments on any post or page that uses the Countdown widget eliminates the exposure with minimal functional impact. Removing or not deploying the Jeg Kit Countdown widget on untrusted-comment pages also breaks the exploitation chain, since the countdown frontend script is never enqueued, though this reduces site functionality. A web application firewall or plugin-level input filtering rule that blocks script and Elementor-style data attributes in comment fields can add defense in depth, but trade-offs include false positives on legitimate comment markup and no protection against bypass tuning. Note that no public exploit code has been identified at time of analysis and the vulnerability has not been confirmed actively exploited (not in CISA KEV), so prioritizing the 3.2.17 upgrade on sites that both run this plugin and allow unmoderated comments is the appropriate response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-79 cross-site scripting defect in a WordPress/Elementor ecosystem plugin, arising from insufficient input sanitization and output escaping of comment content. The Jeg Kit for Elementor plugin registers an Elementor Countdown widget whose view class (class/elements/views/class-countdown-view.php around line 107) and supporting helper code (helper.php around line 868 and lib/jeg-framework/util/framework-helper.php around line 153) determine when the countdown frontend script (assets/js/elements/countdown.js) is enqueued and how the widget markup is emitted. Because the countdown script initializes against DOM elements matching the widget's markup pattern rather than only against server-rendered widget instances, an attacker who can place crafted markup into a comment can have that markup consumed as if it were a legitimate countdown widget - the missing escaping on comment output is therefore amplified into script execution. The referenced plugin tags (3.2.7 and 3.2.10) show the affected code paths, and the 3.2.16→3.2.17 changeset touches class-countdown-view.php, consistent with a fix that hardens widget rendering/markup matching and the comment-related sanitization. CPE data identifies the affected product as jegtheme:jeg_kit_for_elementor, and the CVSS vector confirms a network-reachable, scope-changing (S:C) XSS with limited confidentiality and integrity impact.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Stored XSS fires only when a victim visits the page (UI:R) and only where a Countdown widget is present plus a comment is published (AC:H); unauthenticated injection keeps PR:N, scope-crossing client-side impact keeps C:L/I:L/S:C.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Jeg Kit for Elementor - Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the targeted post also renders a legitimate Jeg Kit Countdown widget, which causes the countdown frontend script to be enqueued and to initialize on any matching DOM element - including forged widget markup stored in comments.
Executive ViewAI
The Jeg Elementor Kit WordPress plugin, versions up to and including 3.2.16, carries a high-severity stored cross-site scripting flaw that can affect any site where comments are enabled and a legitimate Countdown widget is rendered on the same page. No public exploit identified at time of analysis, but if exploited, unauthenticated attackers could inject scripts that execute in the browsers of visitors and administrators, risking session theft, credential compromise, and reputational harm. Leadership should prioritize interim mitigations because no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: disable comments on pages rendering the Jeg Elementor Kit Countdown widget, require administrator moderation for first-time comments, remove or disable the Countdown widget where non-essential, deploy WAF/virtual patching rules to block script tags and forged Countdown markup in comments, and monitor comment activity for suspicious payloads.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB