# cve.now: Jegtheme

The newest entries naming Jegtheme as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103907](https://cve.now/CVE-2026-103907.md): Jeg Kit for Elementor \<= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg\_find\_author' AJAX Action (CVSS 6.5)
- [CVE-2026-96328](https://cve.now/CVE-2026-96328.md): WordPress JNews - Pay Writer plugin \<= 12.0.1 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-100180](https://cve.now/CVE-2026-100180.md): Jeg Kit for Elementor \<= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment (CVSS 5.4)
- [CVE-2026-18405](https://cve.now/CVE-2026-18405.md): Jeg Kit for Elementor \<= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2)
- [CVE-2026-65549](https://cve.now/CVE-2026-65549.md): WordPress Jeg Elementor Kit plugin \<= 3.2.10 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-2916](https://cve.now/CVE-2026-2916.md): Jeg Kit for Elementor \<= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script (CVSS 4.3)
- [CVE-2026-13710](https://cve.now/CVE-2026-13710.md): Jeg Kit for Elementor \<= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg\_body\_description' Parameter via 'jkit\_image\_box' Shortcode/Widget (CVSS 6.4)
- [CVE-2026-6916](https://cve.now/CVE-2026-6916.md): Jeg Kit for Elementor \<= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg\_content\_number\_prefix' Shortcode Attribute (CVSS 6.4)
- [CVE-2025-68906](https://cve.now/CVE-2025-68906.md): WordPress JNews - Video plugin \<= 11.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-68905](https://cve.now/CVE-2025-68905.md): WordPress JNews - Pay Writer plugin \<= 11.0.0 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-68904](https://cve.now/CVE-2025-68904.md): WordPress JNews - Frontend Submit plugin \<= 11.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-14275](https://cve.now/CVE-2025-14275.md): Jeg Elementor Kit \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2025-67591](https://cve.now/CVE-2025-67591.md): WordPress JNews Paywall plugin \< 12.0.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-67538](https://cve.now/CVE-2025-67538.md): WordPress JNews Gallery plugin \< 12.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-53573](https://cve.now/CVE-2025-53573.md): WordPress Epic Review Plugin \<= 1.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- [CVE-2025-39373](https://cve.now/CVE-2025-39373.md): WordPress JNews Theme \<= 11.6.16 - Broken Access Control Vulnerability (CVSS 5.3)
- [CVE-2025-2944](https://cve.now/CVE-2025-2944.md): Jeg Elementor Kit \<= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets (CVSS 6.4)
- [CVE-2024-13217](https://cve.now/CVE-2024-13217.md): Jeg Elementor Kit \<= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas (CVSS 4.3)
- [CVE-2024-10308](https://cve.now/CVE-2024-10308.md): Jeg Elementor Kit \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget (CVSS 6.4)
- [CVE-2024-8899](https://cve.now/CVE-2024-8899.md): Jeg Elementor Kit \<= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg\_content\_template (CVSS 4.3)
- [CVE-2024-47390](https://cve.now/CVE-2024-47390.md): WordPress Jeg Elementor Kit plugin \<= 2.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-6804](https://cve.now/CVE-2024-6804.md): Jeg Elementor Kit \<= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File (CVSS 6.4)
- [CVE-2024-4479](https://cve.now/CVE-2024-4479.md): Jeg Elementor Kit \<= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets (CVSS 6.4)
- [CVE-2024-3161](https://cve.now/CVE-2024-3161.md): Jeg Elementor Kit \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2024-3819](https://cve.now/CVE-2024-3819.md): Jeg Elementor Kit \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner (CVSS 6.4)
- [CVE-2024-0334](https://cve.now/CVE-2024-0334.md): Jeg Elementor Kit \<= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes (CVSS 6.4)
- [CVE-2024-32721](https://cve.now/CVE-2024-32721.md): WordPress Jeg Elementor Kit plugin \<= 2.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-3162](https://cve.now/CVE-2024-3162.md): Jeg Elementor Kit \<= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial (CVSS 6.4)
- [CVE-2024-1327](https://cve.now/CVE-2024-1327.md): Jeg Elementor Kit \<= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box (CVSS 6.4)
- [CVE-2024-29101](https://cve.now/CVE-2024-29101.md): WordPress Jeg Elementor Kit plugin \<= 2.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-1326](https://cve.now/CVE-2024-1326.md): Jeg Elementor Kit \<= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (CVSS 6.4)
- [CVE-2022-3794](https://cve.now/CVE-2022-3794.md): Jeg Elementor Kit \<= 2.5.6 - Authorization Bypass (CVSS 5.4)
- [CVE-2022-3805](https://cve.now/CVE-2022-3805.md): Jeg Elementor Kit \<= 2.5.6 - Unauthenticated Authorization Bypass (CVSS 8.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/jegtheme
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.