CVE-2025-9978
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the user's browser, potentially leading to session theft, redirects, or other attacks.
Recommendation
Update the Jeg Kit for Elementor plugin to version 2.7.0 or later that fixes this vulnerability. Consider disabling SVG file uploads via xmlrpc.php if not necessary.
Other vulnerabilities in Jeg Kit for Elementor
See all- CVE-2026-65549High
Author PHP Object Injection in Jeg Kit for Elementor versions up to 3.2.10.
- CVE-2026-2916Medium
The Jeg Kit for Elementor plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.1.1 via the enqueue_scripts() method in class/dashboard/class-dashboard.php. It injects a JkitDashboardOption JavaScript object containing full plugin inventory, system environment details, and potentially third-party API credentials.
- CVE-2026-13710Medium
The Jeg Kit for Elementor plugin for WordPress up to version 3.2.6 is vulnerable to stored XSS via the Image Box widget. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts through the 'sg_body_description' parameter.
Original NVD description (English source)
The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS