The Jeg Elementor Kit plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the countdown widget's attributes. This allows authenticated attackers with contributor or higher privileges to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the compromised pages, potentially leading to data theft or session hijacking. The vulnerability affects all plugin versions up to 2.6.4. No official patch or remediation details are currently provided.

An attacker with contributor or higher privileges can exploit this vulnerability to inject persistent malicious scripts into pages using the countdown widget. These scripts execute in the browsers of users who visit the affected pages, potentially leading to unauthorized actions such as theft of sensitive information or session tokens. The vulnerability does not affect availability but impacts confidentiality and integrity. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the countdown widget in the Jeg Elementor Kit plugin. Monitor official vendor channels for updates and apply any released fixes promptly.