CVE-2022-3805highexplotación observadaCWE-639

CVE-2022-3805: fallo de gravedad alta en jegtheme Jeg Kit for Elementor – Powerful…

Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

58Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 8.6epss 1.7%
de la publicación al arma
Publicada en NVD22 dic
VulnCheck+12d
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Productos afectados
jegtheme · Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
CVEs relacionadas — jegtheme Jeg Kit for Elementor – Powerful…

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-3794MEDIUMJeg Elementor Kit <= 2.5.6 - Authorization BypassEPSS 0.7%CVE-2024-3819MEDIUMJeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - BannerEPSS 0.5%CVE-2026-18405HIGHJeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.5%CVE-2024-1326MEDIUMJeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML TagsEPSS 0.5%CVE-2025-2944MEDIUMJeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown WidgetsEPSS 0.4%CVE-2024-3161MEDIUMJeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.4%