CVE-2026-2916
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Jeg Kit for Elementor plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.1.1 via the enqueue_scripts() method in class/dashboard/class-dashboard.php. It injects a JkitDashboardOption JavaScript object containing full plugin inventory, system environment details, and potentially third-party API credentials.
Risk Assessment
Authenticated attackers with contributor-level access or above can extract sensitive configuration data, installed plugin details, and potentially API keys (e.g., Mailchimp) by inspecting the page source. This could lead to further attacks on the system.
Recommendation
Immediately update the Jeg Kit for Elementor plugin to the latest version that fixes this vulnerability. Also restrict user permissions to the minimum necessary.
Other vulnerabilities in Jeg Kit for Elementor
See all- CVE-2026-65549High
Author PHP Object Injection in Jeg Kit for Elementor versions up to 3.2.10.
- CVE-2026-13710Medium
The Jeg Kit for Elementor plugin for WordPress up to version 3.2.6 is vulnerable to stored XSS via the Image Box widget. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts through the 'sg_body_description' parameter.
Original NVD description (English source)
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys.