Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass

Wordfence Intelligence   >   Vulnerability Database   >   Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass
8.6
Authorization Bypass Through User-Controlled Key
CVE CVE-2022-3805
CVSS 8.6 (High)
Publicly Published November 4, 2022
Last Updated January 22, 2024
Researcher Ram - Wordfence

Description

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.

Wordfence blocked 5 attacks targeting this vulnerability in the past 24 hours.

References

Share

Vulnerability Details for Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

Software Type Plugin
Software Slug jeg-elementor-kit (view on wordpress.org)
Patched? Yes
Remediation Update to version 2.5.7, or a newer patched version
Affected Version
  • <= 2.5.6
Patched Version
  • 2.5.7

Recent vulnerabilities in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script
4.3
CVE-2026-2916
Jul 31, 2026
Researcher: Dmitrii Ignatyev
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress <= 3.2.10 - Authenticated (Author+) PHP Object Injection
7.5
CVE-2026-65549
Jul 28, 2026
Researcher: daroo
Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget
6.4
CVE-2026-13710
Jul 9, 2026
Researcher: zaim
Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute
6.4
CVE-2026-6916
May 1, 2026
Researcher: Caspian
Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
6.4
CVE-2025-14275
Jan 7, 2026
Researcher: Webbernaut
Jeg Kit for Elementor – Powerful Elementor Addons, Widgets & Templates for WordPress < 2.6.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
5.4
CVE-2025-9978
Oct 3, 2025
Researcher: Tony
Jeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets
6.4
CVE-2025-2944
May 9, 2025
Researcher: zer0gh0st
Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas
4.3
CVE-2024-13217
Feb 26, 2025
Researcher: Ankit Patel
Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template
4.3
CVE-2024-8899
Nov 25, 2024
Researcher: Ankit Patel
Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget
6.4
CVE-2024-10308
Nov 25, 2024
Researcher: zer0gh0st
# Title CVE ID CVSS Researchers Date
1 Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script CVE-2026-2916 4.3 Dmitrii Ignatyev July 31, 2026
2 Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress <= 3.2.10 - Authenticated (Author+) PHP Object Injection CVE-2026-65549 7.5 daroo July 28, 2026
3 Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget CVE-2026-13710 6.4 zaim July 9, 2026
4 Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute CVE-2026-6916 6.4 Caspian May 1, 2026
5 Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CVE-2025-14275 6.4 Webbernaut January 7, 2026
6 Jeg Kit for Elementor – Powerful Elementor Addons, Widgets & Templates for WordPress < 2.6.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CVE-2025-9978 5.4 Tony October 3, 2025
7 Jeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets CVE-2025-2944 6.4 zer0gh0st May 9, 2025
8 Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas CVE-2024-13217 4.3 Ankit Patel February 26, 2025
9 Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template CVE-2024-8899 4.3 Ankit Patel November 25, 2024
10 Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget CVE-2024-10308 6.4 zer0gh0st November 25, 2024
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation