The vulnerability involves a stored XSS flaw through the 'sg_content_number_prefix' shortcode attribute in Jeg Kit for Elementor. WordPress users with contributor or higher privileges can inject arbitrary scripts that will run in any browser that views the affected page. This flaw is a classic input validation weakness (CWE‑79).

The exploit targets the Jeg Kit for Elementor WordPress plugin from JegTheme. All versions up to and including 3.1.0 are susceptible. No other products or vendors are listed.

The flaw carries a CVSS score of 6.4, indicating substantial risk when exploited. While no EPSS score is provided and it is not found in the CISA KEV catalog, the need for privileged but non‑admin access lowers the barrier for an attacker within a compromised site. An attacker with contributor rights could inject user‑visible script via the shortcode, affecting all site visitors who load the malicious page. The vulnerability is therefore moderately high with respect to exploitability and impact, especially on sites that allow user‑generated content through the plugin.