CVE-2026-65549
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Author PHP Object Injection in Jeg Kit for Elementor versions up to 3.2.10.
Risk Assessment
A user with author role can inject malicious PHP objects, potentially leading to remote code execution or other serious impacts.
Recommendation
Update the Jeg Kit for Elementor plugin to the latest available version that includes the fix.
Other vulnerabilities in Jeg Kit for Elementor
See all- CVE-2026-2916Medium
The Jeg Kit for Elementor plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.1.1 via the enqueue_scripts() method in class/dashboard/class-dashboard.php. It injects a JkitDashboardOption JavaScript object containing full plugin inventory, system environment details, and potentially third-party API credentials.
- CVE-2026-13710Medium
The Jeg Kit for Elementor plugin for WordPress up to version 3.2.6 is vulnerable to stored XSS via the Image Box widget. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts through the 'sg_body_description' parameter.
Original NVD description (English source)
Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.