CVE-2026-18405

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the targeted post also renders a legitimate Jeg Kit Countdown widget, which causes the countdown frontend script to be enqueued and to initialize on any matching DOM element — including forged widget markup stored in comments.

• CWE-79

• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.10/assets/js/elements/countdown.js#L1
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.10/class/elements/views/class-countdown-view.php#L107
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.10/helper.php#L868
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.10/lib/jeg-framework/util/framework-helper.php#L153
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.7/assets/js/elements/countdown.js#L1
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.7/class/elements/views/class-countdown-view.php#L107
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.7/helper.php#L868
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.7/lib/jeg-framework/util/framework-helper.php#L153
• https://plugins.trac.wordpress.org/changeset/3690125/jeg-elementor-kit/trunk/class/elements/views/class-countdown-view.php
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3690125%40jeg-elementor-kit%2Ftags%2F3.2.17&old=3679095%40jeg-elementor-kit%2Ftags%2F3.2.16
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2e4a9e9a-7bdc-4f51-ac3f-d6627b4f62c7?source=cve

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1840The Aclara Metrum Cellular Web Interface is vulnerable to un…8.7
• CVE-2026-18400The Slider, Gallery, and Carousel by MetaSlider – Image Slid…6.4
• CVE-2026-18401The non-blocking (asynchronous) JSON parser in jackson-core …6.9
• CVE-2026-18402The SureDash – Community, Courses & Member Dashboard plugin …6.4
• CVE-2026-18403LimeSurvey Community Edition 7.0.5 contains an authenticated…6
• CVE-2026-18404The Social Chat – Click To Chat App Button plugin for WordPr…6.4
• CVE-2026-18406The SureForms – Contact Form Builder, AI Forms, Payment Form…7.2
• CVE-2026-18408Untrusted data inclusion in pg_dump in PostgreSQL allows a m…8.8
• CVE-2026-18409The WPForms Pro plugin for WordPress is vulnerable to Stored…7.2
• CVE-2026-1841The PixelYourSite – Your smart PIXEL (TAG) & API Manager plu…7.2
• CVE-2026-18411The KARR Security System and SWDS dealer-installed automotiv…8.1
• CVE-2026-18412OpenCart extensions are uploaded as zip files with .ocmod.zi…9.1