Stored Cross-Site Scripting in Jeg Kit for Elementor by WordPress

CVE-2026-18405

What is CVE-2026-18405?

The Jeg Kit for Elementor plugin, utilized for enhancing WordPress sites with powerful widgets and templates, is susceptible to a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping. This issue allows unauthenticated attackers to inject malicious web scripts through comment content on affected pages. When a user accesses such a post, the injected scripts can execute, particularly if the post includes a legitimate Jeg Kit Countdown widget. The exploitation hinges on the widget's frontend script being enqueued and initializing on any element within the document object model (DOM), including forged widget markup embedded in comments.

References