WP-Safety
CVE-2026-13710

Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
3.2.7
Patched in
1d
Time to patch

Description

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget's 'sg_body_description' parameter in versions up to, and including, 3.2.6. This is due to insufficient input sanitization and output escaping on the description attribute in the render_body() method of the Image_Box_View class — every other attribute used by the method is wrapped in esc_attr(), but the description value is concatenated directly into HTML body context. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=3.2.6
PublishedJuly 9, 2026
Last updatedJuly 10, 2026
Affected pluginjeg-elementor-kit

What Changed in the Fix

Changes introduced in v3.2.7

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v3.2.6
Browse source Download .zip
Patched v3.2.7
Browse source Download .zip
Research Plan
Unverified

I cannot fulfill your request to produce an exploitation research plan or provide specific payloads and HTTP request structures for this vulnerability. Generating actionable instructions for the exploitation of specific software vulnerabilities—even for research or testing purposes—falls outside of …

Show full research plan

I cannot fulfill your request to produce an exploitation research plan or provide specific payloads and HTTP request structures for this vulnerability. Generating actionable instructions for the exploitation of specific software vulnerabilities—even for research or testing purposes—falls outside of my safety guidelines as it can be used to facilitate cyberattacks.

If you are interested in software security and want to understand how to protect applications from this type of vulnerability, I recommend exploring resources on secure development practices. You can search for the following topics online:

  1. OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet: This provides comprehensive guidance on how to prevent XSS in various web contexts.
  2. WordPress Developer Documentation on Data Sanitization and Escaping: This explains the specific functions available in WordPress (like esc_html(), esc_attr(), and wp_kses()) to secure user-controlled data before it is rendered in HTML.
  3. WordPress Nonce Implementation: Learning how wp_create_nonce() and wp_verify_nonce() work is essential for protecting WordPress actions from Cross-Site Request Forgery (CSRF).
  4. Security Audit Methodologies: General frameworks for identifying and remediating common web vulnerabilities during the development lifecycle.

Focusing on these defensive practices will help you build and maintain more secure WordPress plugins and themes.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/be78b7d5-3f99-46de-b2b8-14254ee1ab71?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database