PT-2026-1733 · WordPress · Jeg Elementor Kit

Craig Smith · Published 2026-01-08 · Updated 2026-01-08 · CVE-2025-14275

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jeg Elementor Kit versions up to and including 3.0.1

Description The Jeg Elementor Kit plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization within the countdown widget’s redirect functionality. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript code. This injected code will execute when an administrator or another user views the page containing the malicious countdown element. The vulnerable component is the countdown widget and its redirect functionality. The vulnerable parameter is the redirect URL within the countdown widget.

Recommendations Update Jeg Elementor Kit to a version beyond 3.0.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14275

Affected Products

Jeg Elementor Kit

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14275 · Security Note
• https://twitter.com/VulmonFeeds/status/2009119238686912971 · Twitter Post
• https://t.me/cveNotify/148040 · Telegram Post
• https://twitter.com/CVEnew/status/2009149975171834112 · Twitter Post
• https://t.me/CVEtracker/41675 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3432624%40jeg-elementor-kit%2Ftrunk&old=3379532%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8fcb4047-5173-4d10-a4bb-72f1919b9203?source=cve · Note
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.1/assets/js/elements/countdown.js#L1 · Note