Stored Cross-Site Scripting Vulnerability in Unlimited Elements for Elementor Plugin by WordPress

CVE-2025-14274

What is CVE-2025-14274?

The Unlimited Elements for Elementor plugin for WordPress suffers from a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the Button Link field of the Border Hero widget. This issue arises from inadequate input sanitization and output escaping of user-supplied URLs. Attackers with Contributor-level access or higher could exploit this vulnerability to inject arbitrary scripts into pages. These malicious scripts would execute in the browsers of users who access affected pages, potentially leading to data theft or user impersonation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References