THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-14841 — The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is trick

[NVD] CVE-2026-14841 — The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is trick

mednvdPublished 2026-08-02

CVE-2026-14841 CVSS: None Published: 2026-08-02T06:16:35.097

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-14841cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-14841