CVE-2026-13710 is a stored cross-site scripting vulnerability in the Jeg Kit for Elementor plugin for WordPress, specifically affecting the Image Box widget's 'sg_body_description' parameter. The issue arises because the description attribute is concatenated directly into HTML without proper escaping, unlike other attributes that use esc_attr(). This allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. The vulnerability affects versions up to and including 3.2.6. No official patch or remediation level has been provided in the available data.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable parameter. These scripts execute in the browsers of users who view the injected content, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions with the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Image Box widget's description field. Monitor for updates from the vendor regarding patches or official mitigations.