CVE-2026-14817: Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14817?
CVE-2026-14817 has a risk rating of 62, indicating a medium vulnerability severity.
How do I fix CVE-2026-14817?
To fix CVE-2026-14817, update the Element Pack Addons for Elementor plugin to version 8.7.13 or later.
Who is affected by CVE-2026-14817?
Users with contributor-level access or higher are affected by CVE-2026-14817.
What type of vulnerability is CVE-2026-14817?
CVE-2026-14817 is a DOM-Based Stored XSS vulnerability.
What does CVE-2026-14817 allow attackers to do?
CVE-2026-14817 allows attackers to inject arbitrary JavaScript into the browser through unsanitized data attributes.