CVE-2026-2916

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueuescripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...

EUVD-2026-51762

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2026-14596

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

CVE-2026-2916 Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueuescripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...

CVE-2026-2916

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueuescripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...

CVE-2026-2916

The Jeg Kit for Elementor WordPress plugin (up to v3.1.1) is vulnerable to Sensitive Information Exposure via enqueue_scripts() in class-dashboard.php. The plugin injects a JkitDashboardOption inline script containing: (1) full plugin inventory (names, versions, paths, active status), (2) system ...

CVE-2026-2916 Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueuescripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...

CVE-2026-14596

The DynamicKit for Elementor WordPress plugin (versions before 1.0.3 ) is vulnerable to an unauthenticated account takeover due to a lack of host validation on user-supplied URLs. Attackers can inject an attacker-controlled host into the base of the password-reset link sent via email. When a vict...

CVE-2026-14596 DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

CVE-2026-14596

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

EUVD-2026-51720

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

CVE-2026-14596 DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

PT-2026-67045

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

CVE-2026-14596: Improper Authentication

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

PT-2026-67196

Name of the Vulnerable Software and Affected Versions Jeg Kit for Elementor versions prior to 3.1.2 Description The plugin exposes sensitive information through the enqueue scripts function in class/dashboard/class-dashboard.php. It injects a JkitDashboardOption JavaScript object as an inline...

CVE-2026-2916: Exposure of Sensitive Information to an Unauthorized Actor

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueuescripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...

WordPress Exclusive Addons for Elementor plugin <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Exclusive Addons Elementor versions = 2.7.9.8...

WordPress Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information vulnerability

Authenticated Contributor+ Exposure of Sensitive Information vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Jeg Kit for Elementor versions = 3.1.1...

WordPress ElementsKit Elementor Addons plugin < 3.10.01 - Subsite Administrator+ Stored XSS vulnerability

Subsite Administrator+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ElementsKit Elementor addons Lite versions 3.10.01...

CVE-2026-13393: Improper Neutralization of Input During Web Page Generation

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfilteredhtml capability to save them, allowing users with administrative capabiliti...