PT-2026-1733 · WordPress · Jeg Elementor Kit

Craig Smith · Publicado 2026-01-08 · Atualizado 2026-01-08 · CVE-2025-14275

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jeg Elementor Kit versions up to and including 3.0.1

Description The Jeg Elementor Kit plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization within the countdown widget’s redirect functionality. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript code. This injected code will execute when an administrator or another user views the page containing the malicious countdown element. The vulnerable component is the countdown widget and its redirect functionality. The vulnerable parameter is the redirect URL within the countdown widget.

Recommendations Update Jeg Elementor Kit to a version beyond 3.0.1.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-14275

Produtos afetados

Jeg Elementor Kit

Referências · 8

• https://twitter.com/VulmonFeeds/status/2009119238686912971 · Publicação no Twitter
• https://t.me/cveNotify/148040 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2009149975171834112 · Publicação no Twitter
• https://t.me/CVEtracker/41675 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-14275 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3432624%40jeg-elementor-kit%2Ftrunk&old=3379532%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail= · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/8fcb4047-5173-4d10-a4bb-72f1919b9203?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.1/assets/js/elements/countdown.js#L1 · Nota