What is the CVSS score of CVE-2026-6916?

CVE-2026-6916 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Jeg Kit for Elementor CVE-2026-6916

EUVD-2026-26748 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

WordPress XSS Elementor

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 06:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 06:00 euvd

EUVD-2026-26748

Analysis Generated

May 02, 2026 - 06:00 vuln.today

CVE Published

May 02, 2026 - 05:29 nvd

MEDIUM 6.4

DescriptionCVE.org

The Jeg Kit for Elementor - Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sg_content_number_prefix' parameter in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Jeg Kit for Elementor WordPress plugin versions up to 3.1.0 allows authenticated contributors and above to inject arbitrary JavaScript via the 'sg_content_number_prefix' parameter, which executes when any user accesses the affected page. The vulnerability stems from insufficient input sanitization and output escaping in the Fun Fact widget element, affecting any WordPress site using this popular page builder addon. CVSS score of 6.4 reflects the network attack vector and broad scope, though exploitation requires valid contributor-level credentials.

Technical ContextAI

The vulnerability exists in the Fun Fact widget element of Jeg Kit for Elementor, a plugin that extends the Elementor page builder with additional widgets and templates for WordPress. The flaw involves improper handling of the 'sg_content_number_prefix' parameter in the Fun Fact element view class (class-fun-fact-view.php). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied input from the 'sg_content_number_prefix' parameter is stored in the WordPress database and later rendered on the frontend without proper output escaping using WordPress functions like esc_attr(), esc_html(), or wp_kses_post(). The parameter flows through the elements view abstract class without sanitization, allowing stored XSS payload injection. This affects all versions of the plugin distributed via WordPress.org plugin repository.

RemediationAI

Update Jeg Kit for Elementor to a patched version released after 3.1.0 through the WordPress plugin dashboard or manually via WordPress.org. As immediate mitigation pending patched release, restrict contributor-level access to only trusted users via the WordPress user management interface and audit existing contributors to remove unnecessary accounts. Additionally, consider temporarily disabling the Fun Fact widget element within Elementor if available, or move Fun Fact pages to draft status until patched. Monitor page revisions and post content via WordPress audit logs (admin dashboard) for unauthorized changes to pages using Fun Fact elements. If a WAF is available, filter requests containing 'sg_content_number_prefix' parameters with encoded script tags, though this is crude and may cause false positives. Verify patch availability through the plugin's changelog and JegTheme advisory channels; no specific patched version number was confirmed in available data, so check plugins.wordpress.org directly after updating.