CVE-2026-14817
Received Received - Intake

Stored XSS in Element Pack Addons for Elementor WordPress Plugin

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: WPScan

Description
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-14817
EUVD
EUVD-2026-51941

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
element_pack addons_for_elementor to 8.7.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Element Pack Addons for Elementor WordPress plugin before version 8.7.13. It allows users with contributor-level access or higher to inject arbitrary JavaScript by passing unsanitized option values through certain data attributes. This JavaScript then executes in the browser of any visitor viewing the affected content due to a bundled front-end library re-parsing and rendering the injected code.

Detection Guidance

Check if the Element Pack Addons for Elementor plugin version is below 8.7.13. Inspect front-end JavaScript for unexpected scripts or payloads in user-contributed content.

Impact Analysis

If you are a visitor to a WordPress site using the vulnerable plugin version, attackers could inject malicious JavaScript that runs in your browser session. This could lead to theft of cookies, session tokens, or sensitive data, redirection to phishing sites, or other malicious activities without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if user data is compromised through this exploit.

Mitigation Strategies

Update the Element Pack Addons for Elementor plugin to version 8.7.13 or higher immediately. Remove or restrict contributor-level access to untrusted users until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14817. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart