Junglewise Threat Intelligence

CVE-2026-13710: Jegtheme Jeg Kit for Elementor Stored XSS in Image Box widget

CVE-2026-13710 · Severity: medium · CVSS 6.4 · Published 2026-07-10

Technologies: Jegtheme Jeg Elementor Kit. Vendors: Jegtheme.

Executive brief

The Jeg Kit for Elementor plugin for WordPress is vulnerable to a security flaw that allows users with contributor-level access or higher to inject malicious scripts into website pages. This plugin provides additional design widgets and templates for the Elementor page builder. If exploited, an attacker could execute code in the browsers of site visitors, potentially leading to unauthorized actions or data theft.

Technical details

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the Image Box widget. Specifically, the 'sg_body_description' parameter processed by the render_body() method in the Image_Box_View class is concatenated directly into the HTML body context without being wrapped in escaping functions like esc_attr(). This vulnerability allows authenticated attackers with Contributor-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute in the context of any user who views the compromised page. The issue is present in versions up to and including 3.2.6.

Affected products

  • Jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress <= 3.2.6

Timeline

  • 2026-07-10: disclosed
  • 2026-07-10: advisory

References