CVE-2026-14841

CVE-2026-14841 is an unauthenticated reflected XSS in King Addons for Elementor, affecting versions prior to 51.1.76. The 'grid setting' parameter reflects user input into an HTML attribute without proper escaping—this is a direct and reliable exploitation path. The CVSS 6.1 score understates the actual risk for a specific reason the metric doesn't capture: AJAX auto-fire breaks the User Interaction assumption. In traditional reflected XSS, the victim must click a malicious link. But when the vulnerable handler fires automatically as the grid renders on page load, the victim only needs to visit the page—the malicious payload executes without any conscious action. In practice, the User Interaction metric should be 'None' for this vulnerability class, which would materially raise the score. The blast radius extends beyond the individual visitor. Because grid settings render on portfolio and archive pages—content designed to be shared and linked—successful exploitation runs in the context of a trusted domain. The attacker's JavaScript inherits all browser trust tokens, session cookies, and potentially credentials for authenticated users, including admin accounts on WordPress multi-site deployments. This compromises the credential layer rather than a single endpoint. Patch adoption alone is insufficient. The WordPress plugin ecosystem has no memory: modified forks persist on customized sites, nulled versions circulate on warez forums, and abandoned installations never update. The exploit technique for AJAX-handler reflected XSS is commoditized—available in exploit databases and institutional threat actor knowledge—years after each individual patch. When you patch this vulnerability, you're not closing a window that only affects current-version deployments; you're addressing one instance of a recurring class against an attack surface that includes everything you've already forgotten. Verify whether your King Addons version is 51.1.76 or later. If you're on an earlier version, update immediately. If you run a multi-site or have authenticated users accessing portfolio pages, treat this as higher priority than the CVSS suggests. Audit any custom forks or modified copies of the plugin, and recognize that even after patching, URLs with the malicious parameter may persist in link shorteners, ad networks, and archived pages.

Reviewed through automated stages and approved by a human before publication.