Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

Published: 10/05/2025 Updated: 12/05/2025

Stored XSS in Jeg Elementor Kit WordPress Plugin via Video and Countdown Widgets

The Jeg Elementor Kit plugin for WordPress has a Stored Cross-Site Scripting vulnerability in its Video Button and Countdown Widgets through version 2.6.12. The issue stems from weak input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages, which will then execute when other users view those pages.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jegtheme jeg elementor kit

CWE-79 https://nvd.nist.gov https://www.first.org/epss https://plugins.trac.wordpress.org/changeset/3290315/https://wordpress.org/plugins/jeg-elementor-kit/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/7baa8cca-96a5-4d6b-86d5-53cd1a4675cf?source=cve

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2025-2944

Vulnerability Summary

References

Vulmon Search

About

Products

Connect