Jeg Kit for Elementor <= 3.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-item-indicator' Attribute
- ID
- WPSEC-2026-0164
- Plugin
- Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress (jeg-elementor-kit)
- Affected
- all versions before 3.2.20
- Remediation
- Update to 3.2.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Jeg Kit for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Jeg Kit for Elementor plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via the Nav Menu widget's 'data-item-indicator' attribute in all versions up to, and including, 3.2.19. This is due to the plugin's front-end JavaScript inserting the value of the data-item-indicator attribute into the page as HTML without verifying that it was rendered by the server, while data attributes are preserved by KSES. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts into pages by adding a crafted element with this attribute to post content, which execute whenever a user accesses the injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0164/
- https://plugins.svn.wordpress.org/jeg-elementor-kit/tags/3.2.20/
- https://wordpress.org/plugins/jeg-elementor-kit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS