Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-100180 · Microsoft / collected KEV context

cve-program · CVE-2026-100180

• https://www.wordfence.com/threat-intel/vulnerabilities/id/961b9a16-0b99-4a56-a158-864d643d5c96?source=cve
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/assets/js/elements/nav-menu.js
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/helper.php#L863
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/lib/jeg-framework/util/framework-helper.php#L144
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/assets/js/elements/video-button.js
• https://wordpress.org/plugins/jeg-elementor-kit/
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.20/assets/js/elements/nav-menu.js

No related operational record is retained in the current change model.