jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress vulnerabilities

24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress version is affected

Latest jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress vulnerabilities

CVE-2026-103907 — Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action (CVSS 6.5)
CVE-2026-100180 — Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment (CVSS 5.4)
CVE-2026-18405 — Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2)
CVE-2026-2916 — Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script (CVSS 4.3)
CVE-2026-13710 — Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget (CVSS 6.4)
CVE-2026-6916 — Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute (CVSS 6.4)
CVE-2025-14275 — Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
CVE-2025-2944 — Jeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets (CVSS 6.4)
CVE-2024-13217 — Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas (CVSS 4.3)
CVE-2024-8899 — Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template (CVSS 4.3)
CVE-2024-10308 — Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget (CVSS 5.4)
CVE-2024-47390 — WordPress Jeg Elementor Kit plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-6804 — Jeg Elementor Kit <= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File (CVSS 5.4)
CVE-2024-4479 — Jeg Elementor Kit <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets (CVSS 5.4)
CVE-2024-3819 — Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner (CVSS 5.4)
CVE-2024-3161 — Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 5.4)
CVE-2024-0334 — Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes (CVSS 5.4)
CVE-2024-32721 — WordPress Jeg Elementor Kit plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-3162 — Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial (CVSS 5.4)
CVE-2024-1327 — Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box (CVSS 5.4)
CVE-2024-1326 — Jeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (CVSS 5.4)
CVE-2024-29101 — WordPress Jeg Elementor Kit plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2022-3805 — Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass (CVSS 7.5)
CVE-2022-3794 — Jeg Elementor Kit <= 2.5.6 - Authorization Bypass (CVSS 4.3)