Stored Cross-Site Scripting Vulnerability in DethemeKit for Elementor Plugin by WordPress

CVE-2025-1526

What is CVE-2025-1526?

The DethemeKit for Elementor plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability through its De Product Display Widget, specifically in the countdown feature. This vulnerability stems from inadequate input sanitization and output escaping protocols. Users with Contributor-level access or higher can exploit this flaw to inject arbitrary web scripts into the pages, leading to potential execution of harmful scripts when users access these compromised pages. It is essential to apply security updates and evaluate the plugin's configurations to mitigate risks associated with this vulnerability.

References