CVE-2025-14732

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14732", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-15T17:34:44.433Z", "datePublished": "2026-04-08T01:24:43.385Z", "dateUpdated": "2026-04-08T16:41:11.729Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:11.729Z"}, "affected": [{"vendor": "elemntor", "product": "Elementor Website Builder \u2013 more than just a page builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.35.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Elementor Website Builder \u2013 More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in all versions up to, and including, 3.35.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20232d70-72b2-47b7-ac7e-ad07892864ef?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/elementor/trunk/modules/wp-rest/classes/elementor-post-meta.php#L67"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/elementor/tags/3.35.5&new_path=/elementor/tags/3.35.6"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-87 Improper Neutralization of Alternate XSS Syntax", "cweId": "CWE-87", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "timeline": [{"time": "2025-12-15T18:13:40.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-07T12:55:13.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T15:57:13.519645Z", "id": "CVE-2025-14732", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:57:21.982Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14732", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T15:57:13.519645Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:57:16.970Z"}}], "cna": {"title": "Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API", "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "elemntor", "product": "Elementor Website Builder \u2013 more than just a page builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.35.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-15T18:13:40.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-07T12:55:13.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20232d70-72b2-47b7-ac7e-ad07892864ef?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/elementor/trunk/modules/wp-rest/classes/elementor-post-meta.php#L67"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/elementor/tags/3.35.5&new_path=/elementor/tags/3.35.6"}], "descriptions": [{"lang": "en", "value": "The Elementor Website Builder \u2013 More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in all versions up to, and including, 3.35.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-87", "description": "CWE-87 Improper Neutralization of Alternate XSS Syntax"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T01:24:43.385Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14732", "state": "PUBLISHED", "dateUpdated": "2026-04-08T15:57:21.982Z", "dateReserved": "2025-12-15T17:34:44.433Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-08T01:24:43.385Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Elementor Website Builder \u2013 more than just a page builder", "vendor": "elemntor", "versions": [{"lessThanOrEqual": "3.35.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Elementor Website Builder \u2013 More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in all versions up to, and including, 3.35.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Elementor Website Builder - More Than Just a Page Builder para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de varios par\u00e1metros de widget en todas las versiones hasta la 3.35.5, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel Colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-14732", "lastModified": "2026-07-25T11:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14732", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T15:57:13.519645Z", "version": "2.0.3"}}]}, "published": "2026-04-08T02:16:02.667", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/elementor/trunk/modules/wp-rest/classes/elementor-post-meta.php#L67"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=/elementor/tags/3.35.5&new_path=/elementor/tags/3.35.6"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20232d70-72b2-47b7-ac7e-ad07892864ef?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-87"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.35.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Elementor Website Builder \u2013 more than just a page builder", "source": "cna", "vendor": "elemntor"}, "product": "elementor_website_builder_\u2013_more_than_just_a_page_builder", "vendor": "elemntor"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T02:21:19.225852+00:00", "value": {"mitigation_remediation": ["Update Elementor to version\u00a03.35.6 or newer.", "If an update cannot be applied immediately, restrict Contributor and higher roles to trusted users until the patch is installed.", "Inspect existing pages for injected scripts and remove them manually."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting causing arbitrary script execution"}, "threat_synthesis": {"affected_systems": "All installations of the Elementor Web\u00adsite\u00a0Builder plugin for WordPress with a version number of 3.35.5 or earlier are affected. The flaw exists in the widget parameter handling code and is present across the plugin\u2019s API endpoints. Vendors or site owners using this plugin should verify that the version installed is 3.35.6 or later to remove the issue.", "description_and_impact": "The vulnerability is a stored cross\u2011site scripting flaw in Elementor Web\u00adsite\u00a0Builder released up to version\u00a03.35.5. By sending specially crafted widget parameters through the REST API, an authenticated user with Contributor or higher access can embed arbitrary JavaScript that is written to the page\u2019s content. When other visitors load the affected page, the injected script runs in their browsers, allowing the attacker to steal session cookies, deface the site, or redirect users to malicious sites.", "risk_and_exploitability": "The severity rating is moderate, with a CVSS score of 6.4. Exploitation requires legitimate authentication with Contributor or higher role through the WordPress REST API; the attacker can then post malicious widget data. Since the vulnerability is not listed in CISA\u2019s KEV catalog and no EPSS score is available, the likelihood of widespread exploitation remains uncertain, but the impact on any site that accepts contributor content is significant."}}}}, "created": "2026-04-08T19:33:36.420741+00:00", "updated": "2026-04-08T19:44:13.970022+00:00", "vendors": ["elemntor", "elemntor$PRODUCT$elementor_website_builder_\u2013_more_than_just_a_page_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}