---
id: CVE-2026-2916
title: >-
  The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive
  Information Exposure in all versions up to, and including, 3.1.1 via the
  `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`
summary: >-
  The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive
  Information Exposure in all versions up to, and including, 3.1.1 via the
  `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The
  plugin injects a …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
published: '2026-08-01'
updated: '2026-08-01'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-2916'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php#L497
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php#L523
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php#L675
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?old_path=%2Fjeg-elementor-kit/tags/3.1.1&new_path=%2Fjeg-elementor-kit/tags/3.1.2
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/a420a8b5-e43e-4c0d-86f3-b35f11efdf46?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00217
epssPercentile: 0.12454
ingestedAt: '2026-08-02T05:17:47.794Z'
---

## Overview

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.