What is the CVSS score of CVE-2026-14841?

CVE-2026-14841 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-14841?

Yes, a public proof-of-concept exploit is available for CVE-2026-14841. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-14841?

Yes, a patch is available for CVE-2026-14841. Update the affected software to the latest version immediately.

King Addons for Elementor CVE-2026-14841

EUVD-2026-51928 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-02 WPScan

GHSA-x8v3-6454-g335

WordPress XSS King Addons For Elementor Unknown

6.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network-accessible AJAX endpoint; no special conditions; mandatory victim click (UI:R); XSS scope change affects browser confidentiality and integrity at Low.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 18:29 vuln.today

CVSS changed

Aug 03, 2026 - 18:22 NVD

6.1 (MEDIUM)

Patch available

Aug 02, 2026 - 07:00 EUVD

CVE Published

Aug 02, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 02, 2026 - 06:00 cve.org

MEDIUM 6.1

DescriptionCVE.org

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.

AnalysisAI

Reflected XSS in King Addons for Elementor (all versions before 51.1.76) permits unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in an unsanitized grid setting parameter reflected verbatim into an HTML attribute via an unauthenticated AJAX endpoint. The attack requires social engineering to deliver a crafted URL to a target user, with no privilege or authentication prerequisite on the server side. A publicly available exploit exists per WPScan; exploitation is not confirmed in CISA KEV, and EPSS at 0.17% (7th percentile) indicates limited observed exploitation at this time.

Technical ContextAI

King Addons for Elementor is a WordPress add-on plugin extending the Elementor page-builder (10M+ installs) with grid, widgets, and layout features. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): a user-supplied grid configuration parameter is accepted by an unauthenticated WordPress AJAX handler and reflected without sanitization or escaping into an HTML attribute in the response. Because the AJAX endpoint is publicly accessible (no authentication gate), any attacker can craft a URL that embeds a JavaScript payload in the parameter. When a victim loads that URL, the server echoes the payload into the rendered HTML and the browser executes it. Affected CPE: cpe:2.3:a:unknown:king_addons_for_elementor:*:*:*:*:*:*:*:* covering versions 0 through less than 51.1.76.

RemediationAI

Update King Addons for Elementor to version 51.1.76 or later via the WordPress admin dashboard (Plugins → Updates), which contains the vendor-released patch resolving the missing output escaping. This is the only confirmed fix; the exact patched version 51.1.76 is confirmed by WPScan and the EUVD advisory. If an immediate update is not operationally feasible, deactivate the plugin entirely - this eliminates exposure but disables all King Addons widgets on Elementor-built pages, which may break site layout. As a secondary compensating control, deploying a WAF rule to block reflected payloads (e.g., script tags, event handlers) in AJAX query parameters can reduce risk but should not substitute for patching, as WAF rules can be bypassed by encoding or evasion. Advisory references: https://wpscan.com/vulnerability/667d1f8d-fcdb-498f-abda-5655a5af7591/ and https://nvd.nist.gov/vuln/detail/CVE-2026-14841.