CVE-2026-100180 is a stored Cross-Site Scripting (CWE-79) vulnerability in the Jeg Kit for Elementor WordPress plugin affecting all versions up to 3.2.19. The flaw is due to improper neutralization of input during web page generation, specifically in comment handling. This allows unauthenticated attackers to inject malicious scripts that persist and execute in the context of users visiting the injected pages. The vulnerability is exacerbated by a widened allowlist that bypasses sanitization regardless of comment approval status, enabling immediate persistence under certain conditions.

An attacker can inject arbitrary web scripts that execute in the browsers of users viewing the compromised pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires no authentication and can result in persistent XSS, increasing the risk and impact. However, the attack complexity is rated high due to the need for specific conditions (such as an email with a previously approved comment) to bypass moderation for immediate persistence. The CVSS 3.1 base score is 5.4 (medium severity), reflecting limited confidentiality and integrity impact and no availability impact.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting comment functionality or applying web application firewall (WAF) rules to detect and block malicious input targeting this plugin. Monitor vendor channels for updates and apply official patches once released.