Jegtheme
Vulnerability activity for Jegtheme: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.5MediumOct 14, 2026Jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress Auth bypass / access controlCVE-2026-103907The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element's full option schema — including a freshly minted wp_create_nonce('jeg_find_author') — to any au
- 9.3CriticalOct 9, 2026Jegtheme JNews - Pay Writer SQL injectionCVE-2026-96328Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.
- 5.4MediumOct 3, 2026Jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress XSSCVE-2026-100180The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Immediate persistence without moderator approval is possible when the
- 7.2HighSep 18, 2026Jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress XSSCVE-2026-18405The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the targeted post also
Top products
- Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress3 CVEs in the last year
- JNews - Pay Writer1 CVE in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.