Jeg Kit For Elementor Powerful Addons For Elementor Widgets Templates For Wordpress
Monthly
Stored cross-site scripting in the Jeg Elementor Kit WordPress plugin (all versions up to and including 3.2.16) allows unauthenticated attackers to inject arbitrary JavaScript into comment content, which then executes in the browser of any user who later views the affected page. The attack is conditional rather than universal: the targeted post must also render a legitimate Jeg Kit Countdown widget, which causes the plugin's countdown frontend script to be enqueued and to initialize on any matching DOM element - including forged Countdown widget markup smuggled into a published comment - and comments must be enabled and the malicious comment published (sites that hold first-time comments for administrator moderation break the unauthenticated path). The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while our independent assessment scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N given the widget dependency, moderation gate, and victim-visit requirement; impact is confined to client-side script execution with no availability impact, and no public exploit code has been identified at time of analysis.
JNews - Jeg Elementor Kit plugin for WordPress (up to and including 3.2.19) is vulnerable to unauthorized data access due to missing capability checks on the 'jkit_post_block' and 'jeg_find_author' AJAX actions. An authenticated attacker with Subscriber-level access or above can exploit this to enumerate all registered users and reconstruct arbitrary users' email addresses character-by-character using a substring search oracle. No public exploit code has been identified at time of analysis, and the issue requires an authenticated low-privilege account, making it a moderate-priority concern rather than a high-urgency emergency.
Stored cross-site scripting in Jeg Kit for Elementor (all versions through 3.2.19) allows unauthenticated attackers to plant persistent JavaScript on WordPress sites through the plugin's comment handling path, which then executes in the browser of any user - including administrators - who later views the poisoned page. Attackers submitting from an email address that already has at least one approved comment on the site can achieve immediate persistence without moderator review, which is the precondition behind the High attack complexity rating (CVSS 5.4, AV:N/AC:H/PR:N/UI:N/S:C); other submissions still bypass sanitization but sit in the standard moderation queue. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority patch-and-remediate item rather than an emergency.
Jeg Kit for Elementor exposes sensitive site configuration data to any authenticated WordPress user with Contributor-level access or above through an unguarded inline JavaScript object injected on the post editor page. The `enqueue_scripts()` method outputs a `JkitDashboardOption` object containing installed plugin names, versions, file paths, active statuses, WordPress and PHP versions, site URLs, server capabilities, and - critically - potentially a Mailchimp API key stored in `jkit_user_data`. No public exploit or CISA KEV listing exists at time of analysis, but the low authentication barrier (Contributor) and the API credential exposure risk elevate real-world impact above the Medium CVSS score alone suggests.
Stored cross-site scripting in Jeg Kit for Elementor WordPress plugin versions up to 3.1.0 allows authenticated contributors and above to inject arbitrary JavaScript via the 'sg_content_number_prefix' parameter, which executes when any user accesses the affected page. The vulnerability stems from insufficient input sanitization and output escaping in the Fun Fact widget element, affecting any WordPress site using this popular page builder addon. CVSS score of 6.4 reflects the network attack vector and broad scope, though exploitation requires valid contributor-level credentials.
Stored cross-site scripting in the Jeg Elementor Kit WordPress plugin (all versions up to and including 3.2.16) allows unauthenticated attackers to inject arbitrary JavaScript into comment content, which then executes in the browser of any user who later views the affected page. The attack is conditional rather than universal: the targeted post must also render a legitimate Jeg Kit Countdown widget, which causes the plugin's countdown frontend script to be enqueued and to initialize on any matching DOM element - including forged Countdown widget markup smuggled into a published comment - and comments must be enabled and the malicious comment published (sites that hold first-time comments for administrator moderation break the unauthenticated path). The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while our independent assessment scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N given the widget dependency, moderation gate, and victim-visit requirement; impact is confined to client-side script execution with no availability impact, and no public exploit code has been identified at time of analysis.
JNews - Jeg Elementor Kit plugin for WordPress (up to and including 3.2.19) is vulnerable to unauthorized data access due to missing capability checks on the 'jkit_post_block' and 'jeg_find_author' AJAX actions. An authenticated attacker with Subscriber-level access or above can exploit this to enumerate all registered users and reconstruct arbitrary users' email addresses character-by-character using a substring search oracle. No public exploit code has been identified at time of analysis, and the issue requires an authenticated low-privilege account, making it a moderate-priority concern rather than a high-urgency emergency.
Stored cross-site scripting in Jeg Kit for Elementor (all versions through 3.2.19) allows unauthenticated attackers to plant persistent JavaScript on WordPress sites through the plugin's comment handling path, which then executes in the browser of any user - including administrators - who later views the poisoned page. Attackers submitting from an email address that already has at least one approved comment on the site can achieve immediate persistence without moderator review, which is the precondition behind the High attack complexity rating (CVSS 5.4, AV:N/AC:H/PR:N/UI:N/S:C); other submissions still bypass sanitization but sit in the standard moderation queue. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority patch-and-remediate item rather than an emergency.
Jeg Kit for Elementor exposes sensitive site configuration data to any authenticated WordPress user with Contributor-level access or above through an unguarded inline JavaScript object injected on the post editor page. The `enqueue_scripts()` method outputs a `JkitDashboardOption` object containing installed plugin names, versions, file paths, active statuses, WordPress and PHP versions, site URLs, server capabilities, and - critically - potentially a Mailchimp API key stored in `jkit_user_data`. No public exploit or CISA KEV listing exists at time of analysis, but the low authentication barrier (Contributor) and the API credential exposure risk elevate real-world impact above the Medium CVSS score alone suggests.
Stored cross-site scripting in Jeg Kit for Elementor WordPress plugin versions up to 3.1.0 allows authenticated contributors and above to inject arbitrary JavaScript via the 'sg_content_number_prefix' parameter, which executes when any user accesses the affected page. The vulnerability stems from insufficient input sanitization and output escaping in the Fun Fact widget element, affecting any WordPress site using this popular page builder addon. CVSS score of 6.4 reflects the network attack vector and broad scope, though exploitation requires valid contributor-level credentials.