CVE-2024-8899

The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the rendercontent function in class/elements/views/class-tabs-view.php. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-53774

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows DOM-Based XSS.This issue affects Sparkle Elementor Kit: from n/a through = 2.0.9...

CVE-2024-51856

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ibllex Moose Elementor Kit moose-elementor-kit allows DOM-Based XSS.This issue affects Moose Elementor Kit: from n/a through = 1.0.0...

CVE-2022-3794

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

CVE-2025-2944

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up to, and including, 2.6.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2025-2944 Jeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up to, and including, 2.6.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2025-2944 Jeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up to, and including, 2.6.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2025-2944

CVE-2025-2944 affects Jeg Elementor Kit (WordPress) up to v2.6.12. Vulnerability: Stored Cross-Site Scripting via Video Button and Countdown Widgets caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access at contributor...

PT-2025-20608 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.6.12 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets due to insufficient input sanitization and outpu...

WordPress plugin Jeg Elementor Kit 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress Jeg Elementor Kit plugin <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Video Button and Countdown Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Jeg Elementor Kit versions = 2.6.12...

CVE-2025-32157

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows PHP Local File Inclusion.This issue affects Sparkle Elementor Kit: from n/a through = 2.0.9...

CVE-2025-32157

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows PHP Local File Inclusion.This issue affects Sparkle Elementor Kit: from n/a through = 2.0.9...

CVE-2025-32157 WordPress Sparkle Elementor Kit plugin <= 2.0.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows PHP Local File Inclusion.This issue affects Sparkle Elementor Kit: from n/a through = 2.0.9...

CVE-2025-32157 WordPress Sparkle Elementor Kit plugin <= 2.0.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Jakub Glos Sparkle Elementor Kit allows PHP Local File Inclusion. This issue affects Sparkle Elementor Kit: from n/a through 2.0.9...

CVE-2025-32157

CVE-2025-32157 : Sparkle Elementor Kit (WordPress) is vulnerable to a Local File Inclusion due to improper filename validation in PHP include/require. Affected: Sparkle Elementor Kit ≤ 2.0.9. Root cause: Improper control of filename for include/require statements. Access: requires authentication ...

WordPress plugin Sparkle Elementor Kit 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-14943 · Unknown · Jakub Glos Sparkle Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jakub Glos Sparkle Elementor Kit versions 2.0.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local...

CVE-2024-13217

The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expireddata' and 'buildcontent' functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...

CVE-2024-13217 Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas

The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expireddata' and 'buildcontent' functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...