CVE-2025-2944

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up to, and including, 2.6.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 10, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-294487.5Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causCVE-2025-294496.5An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function.CVE-2025-29458.8Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with CVE-2025-294506.5An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings component.CVE-2025-294517.6An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component.CVE-2025-294527.6An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Proxy Manager component.CVE-2025-294536.5An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the myCVE-2025-294546.5An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the UpCVE-2025-294556.5An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the TrCVE-2025-294566.5An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the crCVE-2025-294577.6An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputeCVE-2025-294587.6An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes
CVE-2025-2944: Medium severity, CVSS 6.4 | Vulnix