CVE-2026-100180 describes a stored cross-site scripting vulnerability in the Jeg Kit for Elementor WordPress plugin, affecting all versions up to and including 3.2.19. The flaw is due to inadequate input sanitization and output escaping in the comment functionality, enabling unauthenticated attackers to inject malicious scripts that persist and execute in users' browsers when they access the injected pages. The vulnerability allows immediate persistence without moderator approval under certain conditions, specifically when the attacker uses an email address with a previously approved comment, which bypasses sanitization checks.

An attacker can inject persistent malicious scripts into pages via the comment feature, which execute in the context of users visiting those pages. This can lead to information disclosure and limited integrity impact as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). The vulnerability does not require authentication but has a higher attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or moderate comments carefully, especially from untrusted sources. Monitor for suspicious comment activity and consider disabling comments if feasible. Avoid relying on email-based approval bypasses as a security control.