Stored Cross-Site Scripting Vulnerability in HT Slider for Elementor Plugin by WordPress

CVE-2025-14278

What is CVE-2025-14278?

The HT Slider for Elementor plugin for WordPress contains a vulnerability that allows authenticated attackers with Contributor-level access or higher to execute arbitrary web scripts on affected pages. This is made possible through inadequate input sanitization and output escaping of the 'slide_title' parameter in JavaScript. Attackers can leverage this weakness to inject malicious code that executes each time a user accesses a compromised page, thereby exposing sensitive data and breaching website security.

References