{"id":"CVE-2024-4479","aliases":["EUVD-2024-44093","GHSA-9cv8-f6m9-rm59"],"status":"published","title":"Jeg Elementor Kit \u003c= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets","description":"The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes within the plugin's JKit - Tabs and JKit - Accordion widget, respectively, in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00401,"percentile":0.34595,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-06-15T02:02:00Z","modified":"2026-06-17T08:01:57Z","products":[{"vendor":"jegtheme","product":"jeg kit for elementor – powerful addons for elementor, widgets \u0026 templates for wordpress"},{"vendor":"jegtheme","product":"jeg_elementor_kit"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6048ba9-671f-4729-9618-d7a0556a31e6?source=cve","tags":["x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.5/class/elements/views/class-tabs-view.php#L88","tags":["x_transferred","Patch"]},{"url":"https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.5/class/elements/views/class-view-abstract.php#L195","tags":["x_transferred","Patch"]},{"url":"https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.5/class/elements/views/class-accordion-view.php#L22","tags":["x_transferred","Patch"]},{"url":"https://wordpress.org/plugins/jeg-elementor-kit/#developers","tags":["x_transferred","Release Notes"]},{"url":"https://plugins.trac.wordpress.org/changeset/3102228/","tags":["x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4479"},{"url":"https://plugins.trac.wordpress.org/changeset/3102228"},{"url":"https://github.com/advisories/GHSA-9cv8-f6m9-rm59"}],"sources":{"cve":[{"id":"CVE-2024-4479","title":"Jeg Elementor Kit \u003c= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets","description":"The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes within the plugin's JKit - Tabs and JKit - Accordion widget, respectively, in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-06-15T02:02:00.975Z","modified":"2026-04-08T17:21:06.765Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:17.150655Z"}],"euvd":[{"id":"EUVD-2024-44093","description":"The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes within the plugin's JKit - Tabs and JKit - Accordion widget, respectively, in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-06-15T02:02:00Z","modified":"2026-04-08T17:21:06Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:41.449169Z"}],"ghsa":[{"id":"GHSA-9cv8-f6m9-rm59","title":"The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the...","description":"The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes within the plugin's JKit - Tabs and JKit - Accordion widget, respectively, in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-06-15T03:30:36Z","modified":"2024-07-26T15:31:49Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:57:44.645006Z"}],"nvd":[{"id":"CVE-2024-4479","description":"The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes within the plugin's JKit - Tabs and JKit - Accordion widget, respectively, in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-06-15T02:15:51.447Z","modified":"2026-06-17T08:01:57.55Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:05.620461Z"}]}}