CVE-2026-14817

Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor versions prior to 8.7.13

Description Insufficient sanitization of option values passed through data attributes allows users with contributor-level access or higher to perform a Cross-Site Scripting (XSS) attack. This occurs when a bundled front-end library re-parses and renders these values in the browser, enabling the injection of arbitrary JavaScript that executes in the session of any visitor viewing the affected content.

Recommendations Update Element Pack Addons for Elementor to version 8.7.13 or later.