CVE-2026-14841 King Addons CVE debrief

Who should care

Administrators of WordPress installations using the King Addons for Elementor plugin, security teams monitoring for JavaScript execution vulnerabilities, and operators of affected systems should prioritize updating to version 51.1.76 or later to mitigate this vulnerability. Vulnerability management teams should review the plugin version and update status across their environments. Security teams should also monitor for suspicious AJAX requests and restrict access to sensitive WordPress pages where possible.

Technical summary

The King Addons for Elementor WordPress plugin before version 51.1.76 does not properly escape user-supplied grid settings in an unauthenticated AJAX response. This allows for arbitrary JavaScript execution in the browser of a visitor loading a crafted page. The vulnerability is reportedly exploitable through a reflected XSS attack vector. Affected systems may be vulnerable to JavaScript execution attacks if an attacker can trick a user into loading a crafted page.

Defensive priority

Administrators of WordPress installations using the King Addons for Elementor plugin should prioritize updating to version 51.1.76 or later to mitigate this vulnerability.

Recommended defensive actions

• Update the King Addons for Elementor plugin to version 51.1.76 or later
• Monitor for suspicious AJAX requests
• Restrict access to sensitive WordPress pages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The King Addons for Elementor WordPress plugin before version 51.1.76 is reportedly affected. Evidence is limited; verify plugin version and update status. Limited source detail suggests that an unauthenticated AJAX response reflects a user-supplied grid setting without proper escaping, potentially allowing for arbitrary JavaScript execution. Defenders should verify the plugin version on affected systems and ensure an update to version 51.1.76 or later is applied. Additional verification may be required to confirm exposure and assess potential impact.

Official resources