The King Addons for Elementor WordPress plugin versions prior to 51.1.76 contain a reflected cross-site scripting (XSS) vulnerability (CWE-79). This occurs because a user-supplied grid setting is not escaped before being included in an HTML attribute within an unauthenticated AJAX response. An attacker can exploit this by tricking a visitor into loading a maliciously crafted page, resulting in arbitrary JavaScript execution in the visitor's browser. This vulnerability is identified as CVE-2026-14841 and has a CVSS v3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a visitor's browser session, potentially leading to information disclosure or manipulation of the user interface. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity with limited impact, but does not affect availability. The vulnerability scope is changed (S:C), meaning the attack can affect resources beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content that may trigger the vulnerable AJAX response. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.