{"id":"CVE-2026-14817","aliases":["EUVD-2026-51941","GHSA-mpqf-3vc4-r52m"],"status":"published","title":"Element Pack Elementor Addons \u003c 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes","description":"The Element Pack Addons for Elementor  WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00431,"percentile":0.3764,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-08-02T06:00:10Z","modified":"2026-08-26T16:31:36Z","products":[{"vendor":"bdthemes","product":"element pack addons for elementor"},{"vendor":"unknown","product":"element pack addons for elementor"}],"references":[{"url":"https://wpscan.com/vulnerability/b2554df8-3083-41cf-8f62-04568ab3a9de/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14817"},{"url":"https://wpscan.com/vulnerability/b2554df8-3083-41cf-8f62-04568ab3a9de"},{"url":"https://github.com/advisories/GHSA-mpqf-3vc4-r52m"}],"sources":{"cve":[{"id":"CVE-2026-14817","title":"Element Pack Elementor Addons \u003c 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes","description":"The Element Pack Addons for Elementor  WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.","status":"published","published":"2026-08-02T06:00:10.952Z","modified":"2026-08-04T17:42:39.218Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-51941","description":"The Element Pack Addons for Elementor  WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.","status":"published","published":"2026-08-02T06:00:10Z","modified":"2026-08-04T17:42:39Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T18:02:22.516769Z"}],"ghsa":[{"id":"GHSA-mpqf-3vc4-r52m","title":"The Element Pack Addons for Elementor  WordPress plugin before 8.7.13 does not sanitize option...","description":"The Element Pack Addons for Elementor  WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.","status":"published","published":"2026-08-02T06:30:21Z","modified":"2026-08-04T18:32:22Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:10:05.423688Z"}],"nvd":[{"id":"CVE-2026-14817","description":"The Element Pack Addons for Elementor  WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.","status":"published","published":"2026-08-02T06:16:34.793Z","modified":"2026-08-26T16:31:36.75Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:34.290716Z"}]}}