What the vulnerability does
01Description
The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32721 is likely a duplicate of this issue.
Explanation of Vulnerability in Simple Terms
02Summary
Jeg Kit for Elementor versions up to 2.6.3 contain a vulnerability that allows authenticated users with low privileges to read or modify data across the WordPress site. The vulnerability stems from improper access control that does not properly restrict user capabilities. The scope is changed, meaning the impact extends beyond the vulnerable component itself.
What an attacker can do
03Attacker Capabilities
Read or modify site data with low-level user account access.
Potential impact on your site
04Site Impact
Unauthorized users can access or alter sensitive site content and data beyond their intended permissions.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
April 3, 2024
CVE published
April 8, 2026
Record updated
