CVE-2026-13710: Jeg Kit for Elementor XSS Vulnerability

CVE-2026-13710 Overview

CVE-2026-13710 is a Stored Cross-Site Scripting (XSS) vulnerability in the Jeg Kit for Elementor plugin for WordPress. The flaw affects all versions up to and including 3.2.6 and stems from insufficient input sanitization in the Image Box widget. The sg_body_description parameter is concatenated directly into the HTML body context without escaping in the render_body() method of the Image_Box_View class. Authenticated attackers with Contributor-level access or above can inject arbitrary JavaScript that executes when other users view the affected pages. The vulnerability is tracked under [CWE-79] and was published to the National Vulnerability Database (NVD) on July 10, 2026.

Critical Impact
Authenticated contributors can inject persistent JavaScript payloads that execute in the browsers of site visitors and administrators, enabling session theft, account takeover, and content manipulation.

Affected Products

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
All plugin versions up to and including 3.2.6
WordPress sites using the Image Box widget from this plugin

Discovery Timeline

2026-07-10 - CVE-2026-13710 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-13710

Vulnerability Analysis

The vulnerability resides in the render_body() method of the Image_Box_View class within the Jeg Elementor Kit plugin. The method renders attributes for the Image Box widget in HTML body context. Every attribute processed by this method is wrapped in esc_attr() for safe output, except the description value. That single omission creates a stored XSS sink reachable by any user with Contributor privileges or higher.

Stored XSS on WordPress is particularly effective because payloads persist in the post database and execute whenever a visitor loads the injected page. Administrators viewing a contributor's submission in preview mode are equally exposed, which places the attack in scope for privilege escalation via session theft or forced administrative actions.

Root Cause

The root cause is inconsistent output escaping in the widget's rendering logic. The sg_body_description value is concatenated directly into HTML output without passing through esc_html(), wp_kses_post(), or esc_attr(). WordPress security guidance requires context-aware escaping at the point of output. The plugin's mixed approach — escaping siblings but not the description — reflects a code review gap rather than a broader architectural flaw.

Attack Vector

An attacker authenticated as a Contributor edits or creates a page containing the Image Box widget. In the description field of the widget, the attacker supplies an HTML payload containing an event handler such as onerror or onload on an image or SVG element. When the page is previewed by an editor, published by an administrator, or viewed by any site visitor, the payload executes in the victim's browser under the site's origin. The scope is marked as changed in the CVSS vector, reflecting the ability to affect visitor sessions distinct from the attacker's compromised account. The vulnerability is described in the Wordfence Vulnerability Report and traced to specific lines in the plugin source at line 72 of class-image-box-view.php.

Detection Methods for CVE-2026-13710

Indicators of Compromise

Post or page content containing HTML event handlers such as onerror, onload, or onclick inside Image Box widget description fields.
Presence of <script>, <svg>, or <iframe> tags within sg_body_description metadata stored in the wp_postmeta table.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after previewing contributor submissions.
Newly created administrator accounts or modified user roles that correlate with contributor activity on Image Box pages.

Detection Strategies

Query the WordPress database for wp_postmeta rows where meta_value associated with Elementor data contains suspicious script patterns.
Review contributor and author activity logs for edits to pages using the Image Box widget from the Jeg Elementor Kit plugin.
Deploy a Web Application Firewall (WAF) with rules that inspect POST requests to admin-ajax.php and Elementor's edit endpoints for XSS payloads.

Monitoring Recommendations

Enable WordPress audit logging to record post revisions, user role changes, and plugin configuration edits.
Alert on browser-side script errors reported via a Content Security Policy (CSP) report-uri endpoint on production pages.
Track anomalous authenticated session activity, particularly Contributor accounts submitting unusual volumes of page edits.

How to Mitigate CVE-2026-13710

Immediate Actions Required

Update the Jeg Kit for Elementor plugin to a version later than 3.2.6 as soon as a patched release is available from the vendor.
Audit existing pages built with the Image Box widget for injected scripts and revert any suspicious revisions.
Restrict Contributor-level and higher account provisioning to trusted users only, and review current role assignments.

Patch Information

Refer to the WordPress Jeg Elementor Kit Changeset for the vendor's remediation commit. The fix wraps the description attribute in an appropriate escaping function before output. Site administrators should verify the installed plugin version and apply updates through the WordPress plugin manager.

Workarounds

Disable the Jeg Kit for Elementor plugin until a patched version is installed if immediate updating is not possible.
Remove the Image Box widget from available Elementor elements for lower-privileged roles using a role management plugin.
Deploy a WAF rule blocking HTML tags and event handler attributes in POST parameters targeting Elementor editor endpoints.
Enforce a strict Content Security Policy that disallows inline script execution on published pages.

bash

# Configuration example: WordPress CLI check for plugin version and role restriction
wp plugin get jeg-elementor-kit --field=version
wp user list --role=contributor --fields=ID,user_login,user_registered
# Add a restrictive CSP header via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"