WordPress Plugin Vulnerabilities

King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

Description

The plugin does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.

Proof of Concept

Affects Plugins

Plugin icon
king-addons
Fixed in 51.1.76

References

CVE
CVE-2026-14841

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
V1T
Submitter
V1T
Submitter website
https://v1t.site/
Verified
Yes
WPVDB ID
667d1f8d-fcdb-498f-abda-5655a5af7591

Timeline

Publicly Published
2026-07-20 (about 13 days ago)
Added
2026-07-20 (about 12 days ago)
Last Updated
2026-07-20 (about 12 days ago)

Other

Published
Title
Published
2025-01-16
Title
imaGenius <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-03-19
Title
LIVE TV <= 1.2 - Reflected Cross-Site Scripting
Published
2026-07-20
Title
Spectra < 2.19.29 - Contributor+ Stored XSS via uagb/image Block
Published
2024-02-22
Title
ProfilePress < 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode
Published
2024-06-11
Title
CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More < 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets