CVE-2025-14732

OVERVIEW The Elementor Website Builder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.35.5. The flaw exists in multiple widget parameters due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level permissions or higher can inject malicious scripts into pages, which execute when other users access the compromised content. SEVERITY This vulnerability carries a CVSS score of 6.4 (Medium) with a network-based attack vector requiring low complexity and low privileges. The attack requires user interaction through page access but impacts confidentiality and integrity across site scope. The FAUCET Risk Score of 44.0/100 indicates moderate risk, though the extremely low EPSS score of 0.00011 suggests minimal real-world exploitation likelihood relative to other disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog and shows no presence on active exploitation tracking lists. No public exploit code or significant community exploitation activity has been reported, indicating this remains a theoretical threat requiring proactive patching by WordPress administrators managing Elementor implementations.