Quick answers
- Is CVE-2026-14817 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14817 being exploited in the wild.
- How severe is CVE-2026-14817?
- Medium severity, with a CVSS score of 6.8, published 2 August 2026.
- Which products and versions are affected?
- BdThemes Element Pack Elementor Addons before 8.7.13.
- Is there a fix for CVE-2026-14817?
- A patch was published on 2026-08-02: Fixed in version 8.7.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14817 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14817?
- Check whether you run BdThemes Element Pack Elementor Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the bundled UIKit front-end library integration. The plugin does not sanitize option values passed through data attributes (specifically `data-bdt-lightbox` and related attributes) before the UIKit library re-parses and renders them in the browser. Attackers with contributor-level access or higher can inject arbitrary JavaScript through custom HTML blocks using payloads that encode or obfuscate HTML entities (e.g., `<` and `>`), which survive server-side sanitization and are decoded back to executable code client-side. The vulnerability affects all front-end pages by default, and the payload persists in the database, executing against every subsequent visitor. The issue is fixed in version 8.7.13.
Affected products
- BdThemes Element Pack Elementor Addons before 8.7.13
Timeline
- 2026-07-21: disclosed
- 2026-08-02: advisory
- 2026-08-02: patched: Fixed in version 8.7.13