CVE Database /
CVE-2024-4479
CVE · Medium
CVE-2024-4479 — Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit] < 2.6.6
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-4479
|
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit] < 2.6.6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 2.6.6
|
2.6.6 |
2024-06-14 |
—
|
CVE-2024-4479
The Jeg Elementor Kit plugin contains a stored cross-site scripting vulnerability affecting the Tabs and Accordion widgets through the sg_general_toggle_tab_enable and sg_accordion_style parameters in versions up to 2.6.5. Authenticated users with Contributor privileges or higher can inject malicious scripts into pages due to inadequate sanitization and escaping of these attributes. When other users view the compromised pages, the injected scripts execute in their browsers. The vulnerability was patched in version 2.6.6.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings