CVE-2026-2916

Name of the Vulnerable Software and Affected Versions Jeg Kit for Elementor versions prior to 3.1.2

Description The plugin exposes sensitive information through the enqueue scripts() function in class/dashboard/class-dashboard.php. It injects a JkitDashboardOption JavaScript object as an inline script on the post.php admin page. This object contains the full plugin inventory, system environment details such as WordPress and PHP versions, site URLs, server capabilities, and potentially third-party API credentials via the jkit user data variable. Since the data is output without sufficient capability checks, any authenticated user with Contributor-level access or higher can extract this configuration data by inspecting the page source.

Recommendations Update the plugin to version 3.1.2 or later.