Stored Cross-Site Scripting Vulnerability in Jeg Elementor Kit Plugin

CVE-2024-1327

Summary

The Jeg Elementor Kit plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability that affects all versions up to and including 2.6.3. This vulnerability arises due to inadequate input sanitization and output escaping in the plugin's image box widget. Authenticated users with contributor-level permissions or higher can exploit this flaw to inject arbitrary web scripts into pages, which can be executed when other users access these compromised pages. This can result in various security issues, ranging from unauthorized data access to complete control over affected sites.

References