CVE-2026-14841: King Addons for Elementor XSS Vulnerability

CVE-2026-14841 Overview

CVE-2026-14841 is a reflected Cross-Site Scripting (XSS) vulnerability in the King Addons for Elementor WordPress plugin in versions before 51.1.76. The plugin fails to escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response. Attackers can execute arbitrary JavaScript in a visitor's browser when the victim is tricked into loading a crafted page. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and actions performed on behalf of the targeted user.

Affected Products

King Addons for Elementor WordPress plugin versions prior to 51.1.76
WordPress sites using vulnerable versions of the plugin with public-facing AJAX endpoints
Any site visitor loading a crafted URL served by an affected installation

Discovery Timeline

2026-08-02 - CVE-2026-14841 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-14841

Vulnerability Analysis

The vulnerability resides in an unauthenticated AJAX handler within the King Addons for Elementor plugin. The handler accepts a grid setting supplied by the client and reflects the value into an HTML attribute in the response without proper escaping. Because the endpoint requires no authentication, any attacker capable of crafting a URL can trigger the reflection.

When a victim visits an attacker-controlled page or link, the crafted payload breaks out of the intended HTML attribute context and executes as JavaScript in the visitor's browser. The scope change indicated by the vulnerability metrics reflects the fact that injected script runs in the security context of the vulnerable WordPress site, not the attacker's origin.

Successful exploitation lets the attacker perform actions in the browser of any visitor tricked into loading the crafted page. This includes reading session cookies not marked HttpOnly, submitting forms as the user, and pivoting to administrative actions if an administrator triggers the payload. Refer to the WPScan Vulnerability Report for additional technical detail.

Root Cause

The root cause is missing output encoding. The plugin trusts a client-controlled grid setting and inserts it into an HTML attribute without applying esc_attr() or an equivalent WordPress escaping function. This violates the standard rule that all dynamic values reflected into HTML must be encoded for the destination context.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL containing a malicious grid setting value and delivers it through phishing, forum posts, or malvertising. When the victim loads the page, the browser issues the AJAX request, receives the reflected payload, and executes the injected script under the target site's origin.

The vulnerability is exploitable over the network without authentication or privileges, but the required user interaction limits automated mass exploitation. No public proof-of-concept exploit is currently listed, and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-14841

Indicators of Compromise

AJAX requests to King Addons for Elementor endpoints containing HTML entities, angle brackets, or javascript: schemes in grid parameters
Response payloads reflecting unencoded <script>, onerror, onload, or onmouseover strings inside HTML attributes
Referer headers pointing to unknown external domains preceding requests to plugin AJAX handlers
Unusual outbound requests from visitor browsers to attacker-controlled domains after loading pages served by the affected site

Detection Strategies

Inspect web server access logs for AJAX requests to King Addons endpoints containing suspicious characters such as <, >, ", or URL-encoded equivalents in grid setting parameters
Deploy a Web Application Firewall (WAF) rule that flags reflected XSS patterns in query strings targeting the plugin's AJAX routes
Use browser Content Security Policy (CSP) violation reports to identify inline script execution originating from plugin responses

Monitoring Recommendations

Ingest WordPress access logs and WAF alerts into a centralized SIEM for correlation of reflected XSS patterns
Monitor administrator session activity for unexpected actions immediately after visits to plugin-rendered pages
Track plugin version inventory across managed WordPress sites to identify installations below 51.1.76

How to Mitigate CVE-2026-14841

Immediate Actions Required

Update the King Addons for Elementor plugin to version 51.1.76 or later on all WordPress installations
Audit administrator and editor accounts for unexpected content changes or new users created after the vulnerability window
Deploy WAF rules blocking known reflected XSS payloads targeting the plugin's AJAX endpoints until patching is complete
Rotate session cookies and force re-authentication for privileged users on affected sites

Patch Information

The vendor addressed the issue in King Addons for Elementor version 51.1.76 by adding proper output escaping to the affected grid setting before it is reflected into the HTML attribute. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the King Addons for Elementor plugin until the patched version can be installed
Restrict access to the affected AJAX endpoint at the web server or WAF layer for unauthenticated requests
Implement a strict Content Security Policy that disallows inline script execution to reduce the impact of reflected payloads

bash

# Update King Addons for Elementor via WP-CLI
wp plugin update king-addons-for-elementor --version=51.1.76

# Verify installed version
wp plugin get king-addons-for-elementor --field=version

# Temporary mitigation: deactivate the plugin
wp plugin deactivate king-addons-for-elementor