CVE-2025-14732
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in all versions up to, and including, 3.35.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.4
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- EPSS probability
- 0.34%
- CWE
- CWE-87
- Published
- 2026-04-08
- Last modified
- 2026-04-08
Affected products
- elemntor Elementor Website Builder – more than just a page builder
Weakness type
Related vulnerabilities
- CVE-2026-79946 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-54002 — Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
- CVE-2026-55661 — TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes
- CVE-2026-55237 — AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
- CVE-2026-46492 — md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
- CVE-2026-25688 — Apache Answer: XSS in AI Answer Rendering
- CVE-2026-45314 — Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
- CVE-2026-42458 — Magento LTS: Reflected XSS - Import -> Data Flow (profiles)