CVE-2026-13710: Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget
The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget's 'sgbodydescription' parameter in versions up to, and including, 3.2.6. This is due to insufficient input sanitization and output escaping on the description attribute in the renderbody() method of the ImageBoxView class — every other attribute used by the method is wrapped in escattr(), but the description value is concatenated directly into HTML body context. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templatesto a version that resolves this vulnerability.Fixed in 3.2.6 - Compensating control
Restrict Contributor+ (authenticated) users’ ability to add/edit Elementor content (and specifically the Image Box widget/shortcode parameters) to reduce the risk of stored XSS exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13710?
The severity of CVE-2026-13710 is medium, rated at 6.4.
How do I fix CVE-2026-13710?
To fix CVE-2026-13710, update the Jeg Kit for Elementor plugin to the latest version beyond 3.2.6.
What type of vulnerability is CVE-2026-13710?
CVE-2026-13710 is a Stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-13710?
Users of Jeg Kit for Elementor plugin versions up to and including 3.2.6 are affected by CVE-2026-13710.
What component is vulnerable in CVE-2026-13710?
The vulnerable component in CVE-2026-13710 is the 'sg_body_description' parameter of the Image Box widget.