WordPress plugin
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 24 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium21
- Low0
All Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress vulnerabilities
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
≤3.2.19Update to 3.2.20
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment
≤3.2.19Update to 3.2.20
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
≤3.2.16Update to 3.2.17
- Medium4.3Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script
≤3.1.1Update to 3.1.2
- High7.5Authenticated (Author+) PHP Object Injection
≤3.2.10Update to 3.2.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget
≤3.2.6Update to 3.2.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute
≤3.1.0Update to 3.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
≤3.0.1Update to 3.0.2
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via SVG
≤2.6.9Update to 2.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets
≤2.6.12Update to 2.6.13
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas
≤2.6.11Update to 2.6.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget
≤2.6.9Update to 2.6.10
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template
≤2.6.9Update to 2.6.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.6.8Update to 2.6.9
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File
≤2.6.7Update to 2.6.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets
≤2.6.5Update to 2.6.6
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes
≤2.6.4Update to 2.6.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
≤2.6.4Update to 2.6.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner
≤2.6.4Update to 2.6.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial
≤2.6.3Update to 2.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box
≤2.6.3Update to 2.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
≤2.6.2Update to 2.6.3
- High8.6Unauthenticated Authorization Bypass
≤2.5.6Update to 2.5.7
- Medium5.4Authorization Bypass
≤2.5.6Update to 2.5.7
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress: common questions
Does Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress have known vulnerabilities?
Yes. VulnCrest Radar lists 24 known vulnerabilities in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress: 3 high, 21 medium. None are known to affect version null.
How do I check which version of Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress vulnerability?
CVE-2026-103907, published Oct 13, 2026: Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action. Severity: Medium (CVSS 6.5).
Is any Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress vulnerability listed in CISA KEV?
No. None of the known Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress vulnerabilities is currently listed in the CISA KEV catalog.