The Jeg Elementor Kit plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in its Countdown widget due to improper neutralization of input during web page generation. This allows authenticated users with contributor-level privileges or higher to inject arbitrary JavaScript code into pages, which executes in the context of users viewing those pages. The vulnerability affects all versions up to and including 2.6.9. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an attacker with contributor-level access to inject persistent malicious scripts into pages generated by the plugin. This can lead to unauthorized actions performed in the context of other users viewing the injected pages, potentially compromising user data confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit contributor-level access to trusted users only and consider disabling or removing the affected Countdown widget if possible. Monitor vendor channels for updates regarding patches or official mitigations.