CVE-2026-13710: Jeg Kit for Elementor Stored XSS in Image Box Widget

Technical summary

CVE-2026-13710 is a Stored XSS vulnerability in the Jeg Kit for Elementor WordPress plugin's Image Box widget component. The flaw resides in the render_body() method of the Image_Box_View class, where the 'sg_body_description' parameter is concatenated directly into HTML output without proper escaping. While other attributes processed by this method are wrapped in esc_attr() for safe HTML attribute context, the description value is placed into the HTML body and receives no escaping. This allows authenticated attackers with Contributor-level permissions or above to inject arbitrary JavaScript that persists in the database and executes in the context of other users' browsers. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score of 6.4 (MEDIUM) reflects network-based exploitation, low attack complexity, and requirement for authenticated access, with cross-site scope impact affecting confidentiality and integrity.

Business impact

Organizations using Jeg Kit for Elementor to build WordPress pages face risk of account compromise for site editors and visitors. Attackers with Contributor access could deface pages, steal session cookies, redirect users to malicious sites, or harvest credentials. Since the XSS is stored, every visitor to an affected page is exposed until remediation occurs. For agencies or freelancers managing client WordPress sites, a compromised plugin creates liability and trust damage. The attack surface is particularly concerning in multi-user WordPress environments where numerous contributors may have access to the page builder.

Affected systems

The vulnerability affects Jeg Kit for Elementor versions up to and including 3.2.6. Any WordPress installation with this plugin installed and activated is at risk if users with Contributor role or above can access the Elementor page builder and create or edit Image Box widgets. Risk is highest on sites with multiple content creators or agencies managing client sites where contributor access is broadly distributed.

Exploitability

Exploitation requires authenticated WordPress access at Contributor level or above—a relatively low barrier on many WordPress sites, especially those with freelance writers or client portals. Once authenticated, the attacker can inject malicious code directly via the Image Box widget's description field in the Elementor editor. The stored nature of the vulnerability means the payload executes automatically for all subsequent visitors without requiring phishing or social engineering. No user interaction is needed beyond normal page access. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low attack complexity and no additional user interaction is required, making this straightforward to exploit once authenticated access is obtained.

Remediation

Update the Jeg Kit for Elementor plugin to the patched version released after 3.2.6. Verify the patched version properly escapes the description parameter using appropriate WordPress escaping functions (such as wp_kses_post() for body context or esc_attr() if used as an attribute). Organizations should apply the patch as soon as it becomes available. Interim mitigations include restricting Contributor-level access to users who genuinely need it, implementing a Web Application Firewall (WAF) rule to block script tags in page builder parameters, and regularly auditing Image Box widgets for suspicious content. Disable the plugin entirely if patching cannot be applied immediately and the vulnerability poses unacceptable risk.

Patch guidance

Monitor the Jeg Kit for Elementor plugin's official repository and vendor advisories for an updated version addressing this vulnerability. When a patched version is released, update immediately via the WordPress admin dashboard (Plugins > Updates). Before updating in production, test the patch in a staging environment to ensure no conflicts with custom site functionality or other plugins. After patching, review any Image Box widgets created during the vulnerable period and verify their description fields contain only legitimate content. Consider enabling automatic plugin updates if your site stability permits, particularly for security-critical plugins.

Detection guidance

Search your WordPress database (wp_posts and wp_postmeta tables) for Image Box widgets with script tags or event handlers in the sg_body_description field. Look for patterns such as '<script>', 'onerror=', 'onclick=', and other common XSS payloads within widget configuration JSON. Monitor database audit logs for large description field values that may indicate injected code. Use WordPress security plugins (such as Wordfence or Sucuri) configured to scan for stored XSS signatures in page meta. Review access logs for Contributor-level user activity during the period the vulnerability existed unpatched. Check the Elementor revision history within affected pages to identify when malicious descriptions were added.

Why prioritize this

This vulnerability merits prompt patching due to the combination of stored persistence, low attack complexity, relatively broad access requirements (any Contributor), and cross-site impact. Unlike reflected XSS, stored XSS exposes every visitor to compromise without requiring additional attack steps. The MEDIUM severity (6.4 CVSS) appropriately reflects the need for prior authentication, but the ease of exploitation and lack of user interaction once authenticated elevates practical risk. Organizations with multiple content creators, client-facing WordPress sites, or high visitor traffic should prioritize this above lower-complexity vulnerabilities.

Risk score, explained

The CVSS v3.1 score of 6.4 (MEDIUM) is driven by: Attack Vector: Network (1.0 modifier) — exploitation is remote via the WordPress dashboard. Attack Complexity: Low (1.0) — no special conditions; the widget is part of normal Elementor workflow. Privileges Required: Low (0.56) — Contributor role is commonly granted and can be acquired by email-based account creation on many sites. User Interaction: None (1.0) — the stored payload executes automatically when others visit the page. Scope: Changed (1.0) — XSS affects the security context of other users and the WordPress admin environment. Confidentiality: Low (0.22) — session tokens or page content could be compromised. Integrity: Low (0.22) — page content can be modified in the context of other users. Availability: None (0) — no denial-of-service impact. The resulting score reflects meaningful risk requiring patching without the urgency of critical vulnerabilities.

Frequently asked questions