CVE-2026-14817 in Element Pack Addons for Elementor Plugin
Summary
by MITRE • 08/02/2026
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
The Element Pack Addons for Elementor WordPress plugin version 8.7.12 and earlier contains a critical cross-site scripting vulnerability that stems from insufficient sanitization of user-provided data within HTML attributes. This flaw exists in the plugin's handling of option values passed through specific data attributes, creating an avenue for persistent cross-site scripting attacks. The vulnerability specifically affects the bundled front-end library which re-parses and renders these attributes in browser contexts without proper validation or sanitization, allowing malicious actors to inject arbitrary JavaScript code that executes in visitors' browsers when they view affected content.
The technical flaw manifests through a lack of input validation within the plugin's data attribute processing pipeline. When contributors or users with equivalent privileges create or modify content using Element Pack Addons, they can embed malicious JavaScript within data attributes that are later processed by the front-end library. This represents a classic server-side template injection vulnerability where user-controllable data flows directly into rendered HTML without appropriate sanitization measures. The vulnerability operates at the intersection of insufficient data validation and improper output encoding, creating an environment where malicious payloads can persist and execute across different user sessions.
The operational impact of this vulnerability extends beyond simple XSS exploitation as it enables attackers to perform various malicious activities including session hijacking, credential theft, defacement of content, and redirection to malicious sites. Since the vulnerability affects users with contributor-level access or higher, it presents a significant risk to WordPress sites where multiple users have editing privileges. The persistent nature of the attack means that any visitor who views content containing the injected JavaScript will execute the malicious code in their browser context, potentially compromising their session cookies, personal information, or system resources. This creates a scalable attack vector that can affect all site visitors and could be leveraged for large-scale data exfiltration or malicious redirection campaigns.
Security practitioners should immediately recommend updating to Element Pack Addons version 8.7.13 or later, which contains the necessary sanitization fixes for this vulnerability. The mitigation strategy should also include implementing proper input validation at multiple levels within the WordPress plugin architecture and establishing regular security audits of third-party plugins. Organizations should consider implementing Content Security Policy headers as an additional defense-in-depth measure to limit the execution of unauthorized scripts even if such vulnerabilities exist. This vulnerability aligns with CWE-79 (Cross-site Scripting) and maps to ATT&CK technique T1566 (Phishing) and T1059 (Command and Scripting Interpreter) within the MITRE ATT&CK framework, highlighting both the exploitation pathways and potential attack vectors available to threat actors.