CVE-2026-14841
Received Received - Intake

Reflected Cross-Site Scripting in King Addons for Elementor WordPress Plugin

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: WPScan

Description
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-14841
EUVD
EUVD-2026-51928

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
king_addons the_king_addons_for_elementor to 51.1.76 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the King Addons for Elementor WordPress plugin before version 51.1.76. It fails to properly escape a user-supplied grid setting, which is then reflected into an HTML attribute without sanitization. This flaw allows attackers to inject malicious JavaScript code that executes in the browser of any visitor who loads a specially crafted page.

Detection Guidance

Check if the King Addons for Elementor plugin is installed and verify its version. If it is below 51.1.76, the system is vulnerable. Inspect network traffic for unauthenticated AJAX responses containing user-supplied grid settings reflected in HTML attributes.

Impact Analysis

If you use the vulnerable version of the King Addons for Elementor plugin, attackers could trick your website visitors into loading a malicious page. This could lead to arbitrary JavaScript execution in their browsers, potentially stealing session cookies, redirecting to phishing sites, or performing actions on their behalf without consent.

Compliance Impact

This vulnerability allows arbitrary JavaScript execution in a visitor's browser through reflected input, which could lead to unauthorized data access or manipulation. This may violate GDPR's requirement for protecting user data integrity and confidentiality, and HIPAA's safeguards for electronic protected health information if exploited in healthcare contexts.

Mitigation Strategies

Update the King Addons for Elementor plugin to version 51.1.76 or later immediately. If updating is not possible, consider disabling the plugin until a patch is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart