CVE-2024-13217mediumCWE-359

CVE-2024-13217: medium-severity vulnerability in jegtheme Jeg Kit for Elementor – Powerful…

Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas

Published · Updated

Follow this CVE+ Monitor Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.4%
The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expired_data' and 'build_content' functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
jegtheme · Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
Related CVEs — jegtheme Jeg Kit for Elementor – Powerful…

In the same product, most dangerous first.

CVE-2022-3805HIGHJeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization BypassEPSS 1.7%CVE-2022-3794MEDIUMJeg Elementor Kit <= 2.5.6 - Authorization BypassEPSS 0.7%CVE-2024-3819MEDIUMJeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - BannerEPSS 0.5%CVE-2026-18405HIGHJeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.5%CVE-2024-1326MEDIUMJeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML TagsEPSS 0.5%CVE-2025-2944MEDIUMJeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown WidgetsEPSS 0.4%