Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comments
- ID
- WPSEC-2026-0163
- Plugin
- Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress (jeg-elementor-kit)
- Affected
- from 2.5.11 before 3.2.20
- Remediation
- Update to 3.2.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Jeg Kit for Elementor on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-100180, on 2026-10-02.
Description
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comments in versions 2.5.11 up to, and including, 3.2.19. This is due to the plugin's wp_kses_allowed_html filters (jkit_allowed_html and jeg_allowed_html) widening the allowed HTML in every KSES context, including comment filtering, so that commenters may submit class and data-* attributes along with div, li, style, link and form markup, combined with the Nav Menu widget's front-end script inserting the value of the data-item-indicator attribute into the page as HTML. This makes it possible for unauthenticated attackers to post forged Nav Menu widget markup in comments that executes arbitrary web scripts whenever a user views the page, on sites where comments are enabled and the page also loads the Jeg Kit Nav Menu widget (for example in a header template). This is a separate issue from CVE-2026-18405 (Countdown widget, fixed in 3.2.17).
References
- https://wpsec.com/vuln/WPSEC-2026-0163/
- https://plugins.svn.wordpress.org/jeg-elementor-kit/tags/3.2.20/
- https://wordpress.org/plugins/jeg-elementor-kit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS