CVE-2026-13710

Name of the Vulnerable Software and Affected Versions Jeg Kit for Elementor versions prior to 3.2.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the description attribute within the render body() method of the Image Box View class. While other attributes are processed using esc attr(), the value of the sg body description parameter in the Image Box widget is concatenated directly into the HTML body context. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 3.2.6. As a temporary mitigation, restrict access to the Image Box widget or avoid using the sg body description parameter until the update is applied.