CVE-2026-14596

Name of the Vulnerable Software and Affected Versions DynamicKit for Elementor versions prior to 1.0.3

Description An issue exists where the plugin fails to validate the host of a user-supplied URL used as the base for password-reset emails. This allows unauthenticated attackers to send a target user a legitimately formatted reset email containing a valid reset key, but with a link pointing to a host controlled by the attacker. If the victim clicks the link, it can lead to account takeover.

Recommendations Update DynamicKit for Elementor to version 1.0.3 or later.