CVE-2026-6916 Overview
CVE-2026-6916 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates plugin for WordPress. The flaw exists in all versions up to and including 3.1.0 and stems from insufficient input sanitization and output escaping on the sg_content_number_prefix parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views an affected page, enabling session theft, redirection, and unauthorized actions in the context of the victim.
Critical Impact
Authenticated contributors can persist arbitrary JavaScript that executes against site visitors, including administrators, through the Fun Fact element's number prefix field.
Affected Products
- Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- All plugin versions up to and including 3.1.0
- WordPress sites running the vulnerable plugin with contributor-level user accounts enabled
Discovery Timeline
- 2026-05-02 - CVE-2026-6916 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-6916
Vulnerability Analysis
The vulnerability resides in the Fun Fact element of the Jeg Kit for Elementor plugin. The sg_content_number_prefix parameter is processed by the element's view rendering logic without adequate sanitization on input or escaping on output. When a contributor edits or creates a page using this Elementor widget, the supplied prefix value is stored in post meta and later rendered directly into the page markup.
Referenced source files include class/elements/elementor/class-fun-fact-elementor.php and class/elements/views/class-fun-fact-view.php, along with the abstract view handler at lib/jeg-element/includes/class/elements/class-elements-view-abstract.php. The rendering path emits attacker-controlled data into HTML context without applying functions such as esc_html() or wp_kses_post(). As a result, payloads containing <script> tags or event handlers execute when the page is loaded by any visitor.
Root Cause
The root cause is missing input validation and missing output encoding on a user-controllable widget parameter. The plugin trusts contributor-supplied content for the prefix field, which violates the WordPress security guidance to treat all editor input as untrusted and escape on output. Refer to the Wordfence Vulnerability Report for additional technical detail.
Attack Vector
An attacker requires an authenticated WordPress account at contributor level or higher. The attacker creates or edits a post containing the Fun Fact Elementor widget and supplies a malicious payload in the sg_content_number_prefix field. Once the post is published or previewed, the script executes in the browser of any user accessing the page, including editors and administrators. Because the scope is changed (S:C), the injected script can affect resources beyond the vulnerable component, such as the WordPress admin session.
No verified public proof-of-concept code is available. See the WordPress Plugin Code Snippet for the unsafe rendering location.
Detection Methods for CVE-2026-6916
Indicators of Compromise
- Post meta entries for the Fun Fact element containing <script>, onerror=, onload=, or javascript: substrings within the sg_content_number_prefix value.
- Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains following access to plugin-rendered pages.
- New administrator accounts or modified user roles created shortly after a contributor edited a page containing the Fun Fact widget.
Detection Strategies
- Audit the WordPress database wp_postmeta table for Elementor data containing the sg_content_number_prefix key with HTML or JavaScript syntax.
- Inspect rendered page HTML for unescaped script content originating from Fun Fact widget regions.
- Review WordPress audit logs for contributor accounts that recently edited pages using Jeg Kit Elementor widgets.
Monitoring Recommendations
- Enable WordPress activity logging to track post revisions made by contributor and author roles.
- Deploy a Web Application Firewall (WAF) with XSS payload signatures targeting Elementor widget parameters.
- Monitor browser-side Content Security Policy (CSP) violation reports to surface inline script execution attempts on plugin-rendered pages.
How to Mitigate CVE-2026-6916
Immediate Actions Required
- Update the Jeg Kit for Elementor plugin to a version newer than 3.1.0 once the vendor publishes a patched release.
- Audit all existing pages using the Fun Fact Elementor widget and remove any HTML or JavaScript content from the number prefix field.
- Review and reduce the privileges of contributor and author accounts, removing any inactive or unnecessary users.
Patch Information
The vulnerability affects all versions through 3.1.0. Site administrators should consult the WordPress Plugin Changeset History and the Wordfence Vulnerability Report to confirm the fixed release and apply the upgrade.
Workarounds
- Temporarily disable the Jeg Kit for Elementor plugin until a patched version is installed.
- Restrict the Fun Fact widget through Elementor role manager settings so contributors cannot edit it.
- Apply a Web Application Firewall rule that blocks HTML tags and event handlers in sg_content_number_prefix request parameters.
- Implement a strict Content Security Policy that disallows inline scripts to limit the impact of stored XSS.
# Example WordPress CLI command to list posts using the vulnerable widget
wp post meta list --format=table | grep "sg_content_number_prefix"
# Disable the plugin until patched
wp plugin deactivate jeg-elementor-kit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
