CVE-2026-100180: Jeg Kit for Elementor XSS Vulnerability

CVE-2026-100180 Overview

CVE-2026-100180 is a stored Cross-Site Scripting (XSS) vulnerability in the Jeg Elementor Kit plugin for WordPress. The flaw affects all versions up to and including 3.2.19 and stems from insufficient input sanitization and output escaping in the comment handling logic. Unauthenticated attackers can inject arbitrary web scripts that execute when any user visits an affected page. Persistence without moderator approval is possible when the attacker submits a comment from an email address that previously had an approved comment. The widened sanitization allowlist bypasses filtering regardless of approval status.

Critical Impact
Unauthenticated attackers can store JavaScript payloads in comments, enabling session theft, administrative action hijacking, and client-side compromise of any visitor to the affected WordPress site.

Affected Products

Jeg Elementor Kit plugin for WordPress — all versions <= 3.2.19
WordPress sites using the Jeg Kit for Elementor addon suite
Deployments relying on default comment moderation with prior approved commenters

Discovery Timeline

2026-10-03 - CVE-2026-100180 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-100180

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]. It resides in the comment handling path exposed by the Jeg Elementor Kit plugin, specifically in the helper routines at helper.php and the framework helper at lib/jeg-framework/util/framework-helper.php. The plugin applies a sanitization allowlist that is broader than required for comment content. As a result, attacker-controlled markup and event handler attributes survive filtering and are rendered inline on pages that display comments.

Client-side rendering components such as assets/js/elements/nav-menu.js and assets/js/elements/video-button.js further consume stored content without proper output escaping. Once an attacker-supplied payload is persisted, every subsequent page view triggers script execution in the visitor's browser session.

Root Cause

The root cause is improper neutralization of user input during web page generation. The plugin extends WordPress's default comment sanitization allowlist to permit additional HTML attributes and tags for its Elementor-rendered widgets. This expanded allowlist admits attributes that can carry JavaScript, and the output path omits context-appropriate escaping.

Attack Vector

An unauthenticated attacker submits a crafted comment containing HTML with script-bearing attributes. If the attacker's email address has at least one previously approved comment, WordPress auto-approves the submission and the payload is published immediately. Even when moderation holds the comment, the sanitization bypass persists through approval. Any authenticated or anonymous visitor that loads the page executes the payload in their browser context, enabling cookie theft, cross-site request forgery against the admin dashboard, and arbitrary DOM manipulation.

// No verified exploitation code available.
// See the Wordfence advisory and the plugin source files at helper.php:L863
// and lib/jeg-framework/util/framework-helper.php:L144 for technical details.

Detection Methods for CVE-2026-100180

Indicators of Compromise

Comments in wp_comments containing HTML tags such as <script>, <svg>, <img> with on* event handlers, or javascript: URIs.
Unexpected outbound requests from browsers rendering pages that embed the Jeg Elementor Kit nav-menu or video-button widgets.
New or modified administrator accounts created shortly after a logged-in admin viewed a page containing user comments.

Detection Strategies

Scan the comment_content column of wp_comments for allowlisted-but-dangerous attributes injected via the plugin's widened sanitization filter.
Monitor WordPress REST and wp-comments-post.php endpoints for POST bodies containing encoded script payloads.
Correlate browser-side Content Security Policy (CSP) violation reports with page URLs that render Jeg Elementor Kit widgets.

Monitoring Recommendations

Enable web server access logging and alert on repeated comment submissions from the same email or IP shortly before suspicious admin activity.
Deploy a web application firewall rule set targeting XSS patterns in comment POST parameters.
Track plugin version inventory and flag any WordPress host still running Jeg Elementor Kit <= 3.2.19.

How to Mitigate CVE-2026-100180

Immediate Actions Required

Update the Jeg Elementor Kit plugin to version 3.2.20 or later, which revises the sanitization allowlist and output escaping in nav-menu.js.
Audit existing comments for malicious HTML and purge or quarantine any entries containing event handlers or script tags.
Rotate administrator session cookies and credentials if comments on authenticated pages were viewed by privileged users.

Patch Information

The vendor addressed the issue in Jeg Elementor Kit 3.2.20. The fix is visible in the updated assets/js/elements/nav-menu.js and the surrounding helper code. See the Wordfence Vulnerability Analysis and the WordPress JEG Elementor Kit Plugin Overview for release details.

Workarounds

Disable the Jeg Elementor Kit plugin until patching is complete if comments are rendered on affected pages.
Disable comments globally or on pages built with Jeg Elementor Kit widgets by setting Discussion Settings > Allow people to submit comments on new posts to off.
Require moderator approval for all comments by disabling the "Comment author must have a previously approved comment" option in WordPress Discussion settings.
Deploy a Content Security Policy that restricts inline script execution on the front end.

bash

# Update the plugin via WP-CLI
wp plugin update jeg-elementor-kit --version=3.2.20

# Verify the installed version
wp plugin get jeg-elementor-kit --field=version