CVE-2025-2944: Jeg Elementor Kit WordPress Plugin XSS

CVE-2025-2944 Overview

CVE-2025-2944 is a Stored Cross-Site Scripting (XSS) vulnerability in the Jeg Elementor Kit plugin for WordPress. The flaw affects all versions up to and including 2.6.12. It exists in the plugin's Video Button and Countdown Widgets, which fail to sanitize user-supplied attributes and escape output correctly.

Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The script executes in the browser of any visitor who loads the compromised page, enabling session theft, forced redirection, and administrative account takeover through privileged victims.

Critical Impact
Contributor-level attackers can persist JavaScript payloads on WordPress pages, potentially escalating to administrator compromise when a privileged user views the injected content.

Affected Products

Jeg Elementor Kit plugin for WordPress — all versions up to and including 2.6.12
Vulnerable widgets: Video Button Widget
Vulnerable widgets: Countdown Widget

Discovery Timeline

2025-05-10 - CVE-2025-2944 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2944

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. The Jeg Elementor Kit plugin exposes widget attributes that accept user-controlled input from any author role at contributor level or above. These attributes are rendered into page output without sufficient sanitization or contextual output escaping.

Because the payload is stored in the WordPress database as part of the page content, execution occurs every time a visitor loads the affected page. The scope is changed (S:C in the CVSS vector), meaning the injected script executes in the security context of the site's origin and can act on behalf of any authenticated viewer, including administrators.

Exploitation requires authentication but no user interaction beyond viewing a compromised page. In WordPress deployments that allow open contributor registration or use guest post workflows, the barrier to entry is low.

Root Cause

The root cause is missing input sanitization on widget attributes accepted by the Video Button and Countdown Widgets, combined with missing output escaping when the widgets render HTML. WordPress provides functions such as wp_kses_post(), esc_attr(), and esc_html() for this purpose, but the vulnerable widget rendering paths in versions up to 2.6.12 do not consistently apply them to user-supplied values.

Attack Vector

An attacker authenticates to the target WordPress site with at least contributor privileges. Using the Elementor editor, the attacker inserts a Video Button or Countdown widget and supplies a malicious payload in one of the affected widget attributes. When the page is saved and later viewed, the payload executes in the visitor's browser under the site's origin.

See the Wordfence Vulnerability Report and the WordPress Trac Changeset for the fix diff and technical detail on the affected attributes.

Detection Methods for CVE-2025-2944

Indicators of Compromise

Unexpected <script> tags, inline event handlers (onerror, onclick, onload), or javascript: URIs stored in WordPress post content referencing Video Button or Countdown widgets.
New or modified pages authored by contributor-level accounts that embed Jeg Elementor Kit widgets shortly before or after publication.
Outbound requests from visitor browsers to unfamiliar domains sourced from pages rendering jeg-elementor-kit widgets.

Detection Strategies

Query the wp_posts table for stored payload patterns such as onerror=, onload=, <script, and javascript: within posts containing jeg_ widget markers.
Audit the plugin version reported in wp-content/plugins/jeg-elementor-kit/jeg-elementor-kit.php to confirm whether the site is running 2.6.12 or earlier.
Review Elementor revision history for contributor-authored edits to Video Button and Countdown widget attributes.

Monitoring Recommendations

Enable Web Application Firewall (WAF) logging for POST requests to /wp-admin/admin-ajax.php involving Elementor save actions from non-editor roles.
Monitor WordPress audit logs for new contributor account registrations followed by page creation activity.
Alert on Content Security Policy (CSP) violations reported from public site pages that host the affected widgets.

How to Mitigate CVE-2025-2944

Immediate Actions Required

Update the Jeg Elementor Kit plugin to a version later than 2.6.12 immediately.
Audit all pages built with Video Button or Countdown widgets and remove any suspicious attribute values.
Review contributor and author accounts and remove those that are unrecognized or inactive.
Rotate administrator session cookies and force password resets if injected scripts may have been executed by privileged users.

Patch Information

The vendor addressed the flaw in a subsequent release published on the WordPress Plugin Developers Page. The corresponding code changes are documented in the WordPress Trac Changeset 3290315, which adds sanitization and escaping to the affected widget attributes.

Workarounds

Restrict contributor and author registration until the plugin is updated, disabling open registration in Settings > General.
Temporarily deactivate the Jeg Elementor Kit plugin if patching cannot be applied immediately.
Deploy a WAF rule that blocks HTML event handlers and <script> fragments in Elementor widget save requests.
Enforce a strict Content Security Policy that disallows inline scripts on public site pages.

bash

# Confirm installed plugin version via WP-CLI
wp plugin get jeg-elementor-kit --field=version

# Update the plugin to the latest patched release
wp plugin update jeg-elementor-kit

# Temporarily deactivate until patched
wp plugin deactivate jeg-elementor-kit