Jeg Kit for Elementor vulnerabilities
3 known CVE vulnerabilities in Jeg Kit for Elementor, translated and rated.
- CVE-2026-65549High
Author PHP Object Injection in Jeg Kit for Elementor versions up to 3.2.10.
- CVE-2026-2916Medium
The Jeg Kit for Elementor plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.1.1 via the enqueue_scripts() method in class/dashboard/class-dashboard.php. It injects a JkitDashboardOption JavaScript object containing full plugin inventory, system environment details, and potentially third-party API credentials.
- CVE-2026-13710Medium
The Jeg Kit for Elementor plugin for WordPress up to version 3.2.6 is vulnerable to stored XSS via the Image Box widget. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts through the 'sg_body_description' parameter.