CVE-2026-18405: Jeg Kit for Elementor XSS Vulnerability

CVE-2026-18405 Overview

CVE-2026-18405 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Jeg Kit for Elementor plugin for WordPress. The flaw affects all versions up to and including 3.2.16. Unauthenticated attackers can inject arbitrary web scripts through the comment content field due to insufficient input sanitization and output escaping. The injected payload executes when a visitor loads a page that also renders a legitimate Jeg Kit Countdown widget, which enqueues the countdown frontend script and initializes on any matching DOM element, including forged widget markup stored inside comments.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages, enabling session theft, admin account takeover, and drive-by redirects against any visitor to an affected post.

Affected Products

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin
All plugin versions up to and including 3.2.16
WordPress sites that render a legitimate Jeg Kit Countdown widget on comment-enabled posts

Discovery Timeline

2026-09-18 - CVE-2026-18405 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-18405

Vulnerability Analysis

The vulnerability originates in how the Jeg Kit Countdown widget handles frontend initialization. When a page contains a legitimate Countdown widget, the plugin enqueues countdown.js and binds initialization logic to any DOM element that matches the widget's expected selector and data attributes. WordPress comment content is not stripped of these widget-shaped attributes, allowing an attacker to submit a comment containing forged Countdown markup. Because comment output is insufficiently sanitized and escaped, the attacker-controlled attributes reach the DOM and are consumed by the countdown initializer as if they were legitimate widget data.

The result is stored XSS that persists across page loads and executes in the context of any visitor, including authenticated administrators. Successful exploitation requires no authentication and no user interaction beyond visiting the affected post.

Root Cause

The root cause is missing input sanitization on comment content combined with missing output escaping when the Countdown widget's frontend script consumes DOM data. The vulnerable code paths reside in class/elements/views/class-countdown-view.php, the assets/js/elements/countdown.js initializer, helper.php, and lib/jeg-framework/util/framework-helper.php. The plugin trusts data attributes on any DOM element matching the countdown selector, without validating that the element originated from a legitimate widget render.

Attack Vector

An unauthenticated remote attacker submits a comment on any post that also renders a Jeg Kit Countdown widget. The comment body contains HTML markup mimicking the Countdown widget structure and data attributes. When another user loads the page, the enqueued countdown.js script scans the DOM, matches the attacker's forged element, and executes the payload embedded in its attributes within the victim's browser session.

Refer to the Wordfence advisory and the upstream fix changeset for the vulnerable code paths.

Detection Methods for CVE-2026-18405

Indicators of Compromise

Comments containing HTML elements with Jeg Kit Countdown class names or data-settings attributes referencing countdown initialization
Unexpected <script> execution or outbound requests originating from comment DOM regions on posts that render a Countdown widget
New or modified WordPress administrator accounts created shortly after suspicious comment submissions
Session cookies observed being exfiltrated to external domains referenced in comment payloads

Detection Strategies

Audit wp_comments for entries containing markup that mirrors the Jeg Kit Countdown widget structure, particularly data-* attributes with JavaScript-like values
Inspect content security policy (CSP) violation reports for inline script or external script loads from comment-rendered pages
Correlate comment submission events with subsequent administrator session activity from unfamiliar IP addresses or user agents

Monitoring Recommendations

Enable web application firewall (WAF) rules that flag or block comment submissions containing widget-shaped HTML attributes
Monitor WordPress access logs for POST requests to wp-comments-post.php followed by anomalous administrative actions
Track plugin version inventory across all WordPress sites and alert when Jeg Kit for Elementor remains at 3.2.16 or earlier

How to Mitigate CVE-2026-18405

Immediate Actions Required

Update the Jeg Kit for Elementor plugin to version 3.2.17 or later across every WordPress installation
Review and delete any suspicious comments that contain HTML markup resembling Countdown widget structure
Force password resets and terminate active sessions for administrator accounts that visited affected posts prior to patching

Patch Information

The vendor addressed the issue in Jeg Kit for Elementor version 3.2.17. The fix is documented in the version changeset overview and the countdown view class changeset. Administrators should apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Disable comments on any post or page that renders a Jeg Kit Countdown widget until the plugin is updated
Remove Countdown widgets from public posts that permit comments, which prevents countdown.js from being enqueued on those pages
Deploy WAF rules that strip HTML attributes matching the Countdown widget signature from incoming comment submissions

bash

# Update the plugin using WP-CLI
wp plugin update jeg-elementor-kit --version=3.2.17

# Verify installed version
wp plugin get jeg-elementor-kit --field=version

# Temporarily disable comments on posts rendering the Countdown widget
wp post update <POST_ID> --comment_status=closed