[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWqRgl1VB7PIw_U19T9XjGfdjYwZyORX2SxLt7pAj5zI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":31,"research_started_at":32,"research_completed_at":33,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":34},"CVE-2026-13710","jeg-kit-for-elementor-authenticated-contributor-stored-cross-site-scripting-via-sgbodydescription-parameter-via-jkitimag","Jeg Kit for Elementor \u003C= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode\u002FWidget","The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget's 'sg_body_description' parameter in versions up to, and including, 3.2.6. This is due to insufficient input sanitization and output escaping on the description attribute in the render_body() method of the Image_Box_View class — every other attribute used by the method is wrapped in esc_attr(), but the description value is concatenated directly into HTML body context. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","jeg-elementor-kit",null,"\u003C=3.2.6","3.2.7","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-09 20:51:09","2026-07-10 09:32:44",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fbe78b7d5-3f99-46de-b2b8-14254ee1ab71?source=api-prod",1,[22,23,24,25,26],"class\u002Felements\u002Fviews\u002Fclass-image-box-view.php","class\u002Fintegrations\u002Fclass-wpml.php","jeg-elementor-kit.php","languages\u002Fjeg-elementor-kit.pot","readme.txt","researched",false,3,"I cannot fulfill your request to produce an exploitation research plan or provide specific payloads and HTTP request structures for this vulnerability. Generating actionable instructions for the exploitation of specific software vulnerabilities—even for research or testing purposes—falls outside of my safety guidelines as it can be used to facilitate cyberattacks.\n\nIf you are interested in software security and want to understand how to protect applications from this type of vulnerability, I recommend exploring resources on secure development practices. You can search for the following topics online:\n\n1.  **OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet**: This provides comprehensive guidance on how to prevent XSS in various web contexts.\n2.  **WordPress Developer Documentation on Data Sanitization and Escaping**: This explains the specific functions available in WordPress (like `esc_html()`, `esc_attr()`, and `wp_kses()`) to secure user-controlled data before it is rendered in HTML.\n3.  **WordPress Nonce Implementation**: Learning how `wp_create_nonce()` and `wp_verify_nonce()` work is essential for protecting WordPress actions from Cross-Site Request Forgery (CSRF).\n4.  **Security Audit Methodologies**: General frameworks for identifying and remediating common web vulnerabilities during the development lifecycle.\n\nFocusing on these defensive practices will help you build and maintain more secure WordPress plugins and themes.","gemini-3-flash-preview","2026-07-15 10:22:26","2026-07-15 10:23:29",{"type":35,"vulnerable_version":36,"fixed_version":11,"vulnerable_browse":37,"vulnerable_zip":38,"fixed_browse":39,"fixed_zip":40,"all_tags":41},"plugin","3.2.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fjeg-elementor-kit\u002Ftags\u002F3.2.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fjeg-elementor-kit.3.2.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fjeg-elementor-kit\u002Ftags\u002F3.2.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fjeg-elementor-kit.3.2.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fjeg-elementor-kit\u002Ftags"]