CVE-2026-14841 is a CWE-79 Cross-Site Scripting vulnerability in the King Addons for Elementor WordPress plugin. The vulnerability arises because the plugin does not escape user-supplied input in a grid setting before reflecting it in an HTML attribute within an unauthenticated AJAX response. This enables remote attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser when they visit a maliciously crafted page. The issue affects versions prior to 51.1.76, but no explicit affected versions or patch information is provided. There is no CVSS score or vendor advisory detailing remediation at this time.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of visitors to a crafted page, potentially leading to session hijacking, defacement, or other client-side attacks. Because the AJAX response is unauthenticated, the attack can be performed without user login. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable AJAX functionality or applying web application firewall rules to block suspicious requests targeting this plugin. Monitor official King Addons for Elementor updates for a security patch addressing this issue.