CVE-2025-14274 is a stored cross-site scripting vulnerability in the Unlimited Elements for Elementor plugin for WordPress, specifically affecting versions up to 2.0.1. The vulnerability exists because the plugin does not properly sanitize or escape input in the Button Link field of the Border Hero widget. Authenticated attackers with Contributor-level privileges or above can inject arbitrary JavaScript code that executes in the context of users visiting the compromised page. This can lead to limited confidentiality and integrity impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and scope change with partial confidentiality and integrity impact but no availability impact.

An attacker with Contributor-level or higher access can inject malicious scripts into pages via the vulnerable widget. When other users visit these pages, the injected scripts execute in their browsers, potentially leading to theft of session tokens, defacement, or other client-side impacts. The confidentiality and integrity of user interactions with the affected site may be partially compromised. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or avoiding use of the Border Hero widget's Button Link field. Monitor for updates from the vendor or plugin maintainers regarding patches or official mitigations.