Jeg Elementor Kit <=2.6.9 Authenticated Stored XSS (CVE-2024-10308)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget 2. Vulnerability Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 3. CVSS Score: 6.4 (Medium) 4. Public Release Date: November 25, 2024 5. Latest Update Date: November 26, 2024 6. Researcher: zer0gh0st 7. Affected Versions: <= 2.6.9 8. Fixed Version: 2.6.10 9. Vulnerability Description: The Jeg Elementor Kit plugin's JKit - Countdown widget is vulnerable to Cross-Site Scripting (XSS) in all versions due to improper input neutralization and output escaping of user-supplied attributes. This allows attackers with contributor-level access to inject arbitrary scripts when a user visits a page. 10. Reference Link: plugins.trac.wordpress.org 11. Vulnerability Database: Wordfence Intelligence Vulnerability Database 12. Vulnerability Score: CVE-2024-10308 13. Vulnerability Severity: Medium (6.4) 14. Public Release Date: November 25, 2024 15. Latest Update Date: November 26, 2024 16. Researcher: zer0gh0st 17. Affected Versions: <= 2.6.9 18. Fixed Version: 2.6.10 19. Vulnerability Description: The Jeg Elementor Kit plugin's JKit - Countdown widget is vulnerable to Cross-Site Scripting (XSS) in all versions due to improper input neutralization and output escaping of user-supplied attributes. This allows attackers with contributor-level access to inject arbitrary scripts when a user visits a page. 20. Reference Link: plugins.trac.wordpress.org 21. Vulnerability Database: Wordfence Intelligence Vulnerability Database 22. Vulnerability Score: CVE-2024-10308 23. Vulnerability Severity: Medium (6.4) 24. Public Release Date: November 25, 2024 25. Latest Update Date: November 26, 2024 26. Researcher: zer0gh0st 27. Affected Versions: <= 2.6.9 28. Fixed Version: 2.6.10 29. Vulnerability Description: The Jeg Elementor Kit plugin's JKit - Countdown widget is vulnerable to Cross-Site Scripting (XSS) in all versions due to improper input neutralization and output escaping of user-supplied attributes. This allows attackers with contributor-level access to inject arbitrary scripts when a user visits a page. 30. Reference Link: plugins.trac.wordpress.org 31. Vulnerability Database: Wordfence Intelligence Vulnerability Database 32. Vulnerability Score: CVE-2024-10308 33. Vulnerability Severity: Medium (6.4) 34. Public Release Date: November 25, 2024 35. Latest Update Date: November 26, 2024 36. Researcher: zer0gh0st 37. Affected Versions: <= 2.6.9 38. Fixed Version: 2.6.10 39. Vulnerability Description: The Jeg Elementor Kit plugin's JKit - Countdown widget is vulnerable to Cross-Site Scripting (XSS) in all versions due to improper input neutralization and output escaping of user-supplied attributes. This allows attackers with contributor-level access to inject arbitrary scripts when a user visits a page. 40. Reference Link: plugins.trac.wordpress.org 41. Vulnerability Database: Wordfence Intelligence Vulnerability Database 42. Vulnerability Score: CVE-2024-10308 43. Vulnerability Severity: Medium (6.4) 44. Public Release Date: November 25, 2024 45. Latest Update Date: November 26, 2024 46. Researcher: zer0gh0st 47. Affected Versions: <= 2.6.9 48. Fixed Version: 2.6.10 49. Vulnerability Description: The Jeg Elementor Kit plugin's JKit - Countdown widget is vulnerable to Cross-Site Scripting (XSS) in all versions due to improper input neutralization and output escaping of user-supplied attributes. This allows attackers with contributor-level access to inject arbitrary scripts when a user visits a page. 50. Reference Link: plugins.trac.wordpress.org 51. Vulnerability Database: Wordfence Intelligence Vulnerability Database 52. Vulnerability Score: CVE-2024-10308 53. Vulnerability Severity: Medium (6.4) 54. Public Release Date: November 25, 2024 55. Latest Update Date: November 26, 2024 56. Researcher: zer0gh0st 57. Affected Versions: <= 2.6.9 58. Fixed Version: 2.6.10 59. Vulnerability Description: The Jeg Elementor Kit plugin's JKit - Countdown widget is vulnerable to Cross-Site Scripting (XSS) in all versions due to improper input neutralization and output escaping of user-supplied attributes. This allows attackers with contributor-level access to inject arbitrary scripts when a user visits a page. 60. Reference Link: plugins.trac.wordpress.org 61. Vulnerability Database: Wordfence Intelligence Vulnerability Database 62. Vulnerability Score: CVE-2024-10308 63. Vulnerability Severity: Medium (6.4) 64. Public Release Date: November 25, 2024 65. Latest Update Date: November 26, 2024 66. Researcher: zer0gh0st 67. Affected Versions: <= 2.6.9 68. Fixed Version: 2.6.10 69. Vulnerability Description: The Jeg Elementor Kit plugin's JKit - Countdown widget is vulnerable to Cross-Site Scripting (XSS) in all versions due to improper input neutralization and output escaping

Goal Reached Thanks to every supporter — we hit 100%!

Jeg Elementor Kit <=2.6.9 Authenticated Stored XSS (CVE-2024-10308)