Jegtheme
26 CVEs across 11 Jegtheme products. Browse Jegtheme vulnerabilities, severities, and proof-of-concept exploits.
Jegtheme products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65549 | High | 7.2 | 2026-08-06 | Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions. |
CVE-2026-2916 | Medium | 4.3 | 2026-08-01 | The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scr… |
CVE-2026-13710 | Medium | 6.4 | 2026-07-10 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-6916 | Medium | 6.4 | 2026-05-02 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-68906 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews - Video jnews-video allows Reflected XSS.T… |
CVE-2025-68905 | High | 7.5 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jegtheme JNews - Pay Writer jnews-pay-… |
CVE-2025-68904 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews - Frontend Submit jnews-frontend-submit al… |
CVE-2025-14275 | Medium | 6.4 | 2026-01-08 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input s… |
CVE-2025-67591 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in jegtheme JNews Paywall jnews-paywall allows Cross Site Request Forgery.This issue affects JNews Paywall: fro… |
CVE-2025-67538 | Medium | 6.5 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews Gallery jnews-gallery allows Stored XSS.Th… |
CVE-2025-53573 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme Epic Review epic-review allows Reflected XSS.Thi… |
CVE-2025-39373 | Medium | 5.3 | 2025-05-19 | Missing Authorization vulnerability in jegtheme JNews jnews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JNews: f… |
CVE-2025-2944 | Medium | 6.4 | 2025-05-10 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up… |
CVE-2024-13217 | Medium | 4.3 | 2025-02-27 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expired_data'… |
CVE-2024-8899 | Medium | 4.3 | 2024-11-26 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the render_content f… |
CVE-2024-10308 | Medium | 6.4 | 2024-11-26 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdown widget in all versions up to, and inc… |
CVE-2024-47390 | Medium | 6.5 | 2024-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme Jeg Elementor Kit jeg-elementor-kit allows Store… |
CVE-2024-6804 | Medium | 6.4 | 2024-08-27 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.7 due to… |
CVE-2024-4479 | Medium | 6.4 | 2024-06-15 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes… |
CVE-2024-3819 | Medium | 6.4 | 2024-05-02 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Banner widget in all versions up to, and includ… |
CVE-2024-3161 | Medium | 6.4 | 2024-05-02 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's attributes in all versions up to, and includ… |
CVE-2024-0334 | Medium | 6.4 | 2024-05-01 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attribute of a link in several Elementor widgets in all… |
CVE-2024-32721 | Medium | 6.5 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jegtheme Jeg Elementor Kit allows Stored XSS.This issue a… |
CVE-2024-3162 | Medium | 6.4 | 2024-04-03 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all versions up to, and includ… |
CVE-2024-1327 | Medium | 6.4 | 2024-04-03 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image box widget in all versions up to, and including… |
CVE-2024-1326 | Medium | 6.4 | 2024-03-21 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and including, 2.6.2 due… |
CVE-2024-29101 | Medium | 6.5 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jegtheme Jeg Elementor Kit allows Stored XSS.This issue a… |
CVE-2022-3805 | High | 8.6 | 2022-12-22 | The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and… |
CVE-2022-3794 | Medium | 5.4 | 2022-12-22 | The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticate… |