Stored Cross-Site Scripting Vulnerability in Jeg Kit for Elementor Plugin by WordPress

CVE-2026-100180

What is CVE-2026-100180?

The Jeg Kit for Elementor plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary JavaScript through comments. When executed, these scripts will run whenever a user accesses the affected page, leading to potential exploitation. An attacker can achieve immediate persistence if they submit a comment from an email address associated with a previously approved comment, thus bypassing the sanitization mechanisms in place.

References