CVE-2025-14732

The record

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in all versions up to, and including, 3.35.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected packages

Related vulnerabilities

• CVE-2026-54002 Kirby is an open-source content management system. CWE-87
• CVE-2026-55661 Tina is a headless content management system. CWE-87
• GHSA-2vcc-5v34-9jc8 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing… CWE-87
• CVE-2026-46492 md-fileserver allows for local viewing of markdown files in a browser. CWE-87
• CVE-2026-25688 Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. CWE-87
• GHSA-32q2-hhr5-6qvv md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) CWE-87
• CVE-2026-45314 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… CWE-87
• CVE-2026-42458 Magento Long Term Support (LTS) is an unofficial, community-driven project provides an… CWE-87