Stored XSS Vulnerability in Jeg Kit for Elementor

The Jeg Kit for Elementor (Powerful Addons for Elementor, Widgets & Templates) plugin for WordPress contains a critical security flaw identified as CVE-2026-18405. The vulnerability resides in the insufficient sanitization and output escaping of user-supplied data within comment fields. All versions of the plugin up to and including 3.2.16 are affected. An unauthenticated attacker can exploit this flaw by injecting malicious JavaScript into a post's comments section. The payload remains dormant until a user views a page on the site that utilizes the Jeg Kit Countdown widget. Once the widget initializes, it forces the execution of the injected script within the context of the victim's browser, potentially allowing attackers to hijack sessions or perform unauthorized actions on behalf of the user.

Impact

Successful exploitation of CVE-2026-18405 leads to stored XSS, allowing unauthenticated attackers to execute arbitrary web scripts in the browser of any user viewing a page containing the Jeg Kit Countdown widget. This poses a significant risk for administrative account takeover, data theft, and unauthorized site manipulation. The vulnerability affects all WordPress instances running Jeg Kit for Elementor version 3.2.16 or earlier.

Recommendation

1. Update the Jeg Kit for Elementor plugin to the latest available version provided by Jegtheme to address the input sanitization flaw in CVE-2026-18405.
2. Audit comments sections on WordPress sites utilizing the Jeg Kit Countdown widget for suspicious markup or script tags.
3. Implement a strict Content Security Policy (CSP) to mitigate the impact of potential XSS vulnerabilities by restricting the sources from which scripts can be executed.