Stored Cross-Site Scripting Vulnerability in Unlimited Elements for Elementor Plugin by WordPress

CVE-2025-14274

What is CVE-2025-14274?

The Unlimited Elements for Elementor plugin for WordPress suffers from a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the Button Link field of the Border Hero widget. This issue arises from inadequate input sanitization and output escaping of user-supplied URLs. Attackers with Contributor-level access or higher could exploit this vulnerability to inject arbitrary scripts into pages. These malicious scripts would execute in the browsers of users who access affected pages, potentially leading to data theft or user impersonation.

References