CVE-2026-2916mediumCWE-200

CVE-2026-2916: medium-severity vulnerability in jegtheme Jeg Kit for Elementor – Powerful…

Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script

Published · Updated

Follow this CVE+ Monitor Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.4%
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
jegtheme · Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
Related CVEs — jegtheme Jeg Kit for Elementor – Powerful…

In the same product, most dangerous first.

CVE-2022-3805HIGHJeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization BypassEPSS 1.7%CVE-2022-3794MEDIUMJeg Elementor Kit <= 2.5.6 - Authorization BypassEPSS 0.7%CVE-2024-3819MEDIUMJeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - BannerEPSS 0.5%CVE-2026-18405HIGHJeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.5%CVE-2024-1326MEDIUMJeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML TagsEPSS 0.5%CVE-2025-2944MEDIUMJeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown WidgetsEPSS 0.4%