CVE-2026-18405

Name of the Vulnerable Software and Affected Versions Jeg Kit for Elementor versions prior to 3.2.17

Description Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages via comment content. The scripts execute when a user accesses the affected page. Exploitation requires the targeted post to render a legitimate Jeg Kit Countdown widget, which triggers the countdown frontend script to initialize on matching DOM elements, including forged widget markup stored in comments.

Recommendations Update Jeg Kit for Elementor to version 3.2.17 or later.