CVE-2026-14817 is a CWE-79 Cross-Site Scripting vulnerability in the Element Pack Addons for Elementor WordPress plugin. The vulnerability arises because option values passed through specific data attributes are not sanitized before being re-parsed and rendered by a bundled front-end library. This enables users with contributor-level or higher privileges to inject arbitrary JavaScript code that executes in the context of visitors viewing the affected content. The plugin versions before 8.7.13 are affected. No CVSS score or official remediation level is provided, and no patch links or vendor advisories are available in the provided data.

An attacker with contributor-level access or higher can inject arbitrary JavaScript code that executes in the browsers of visitors who view the affected content. This can lead to session hijacking, defacement, or other malicious actions performed in the context of the victim's session. The vulnerability affects the confidentiality and integrity of visitor sessions on websites using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 8.7.13, upgrading to version 8.7.13 or later is likely recommended once confirmed. Until then, restrict contributor-level access to trusted users and monitor for updates from the plugin vendor.