PT-2025-43583 · WordPress · Jeg Elementor Kit

Tony · Published 2025-10-24 · Updated 2025-10-24 · CVE-2025-9978

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jeg Kit for Elementor WordPress plugin versions prior to 2.7.0

Description The Jeg Kit for Elementor WordPress plugin does not properly sanitize SVG file contents when uploaded through the xmlrpc.php file, which can result in a cross-site scripting issue. The vulnerable upload process occurs when handling SVG files, potentially allowing an attacker to inject malicious code.

Recommendations Update the Jeg Kit for Elementor WordPress plugin to version 2.7.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-9978

Affected Products

Jeg Elementor Kit

References · 5

• 🔥 https://wpscan.com/vulnerability/cef78a77-c66d-4d62-8d49-140ca2d04d5b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9978 · Security Note
• https://t.me/cveNotify/140131 · Telegram Post
• https://t.me/CVEtracker/35642 · Telegram Post
• https://twitter.com/CVEnew/status/1981607291905302688 · Twitter Post