CVE-2025-14732 is a stored cross-site scripting vulnerability in the Elementor Website Builder WordPress plugin (up to version 3.35.5). The issue arises from insufficient sanitization and escaping of input in multiple widget parameters, allowing authenticated users with Contributor-level privileges or above to inject arbitrary scripts. These scripts execute in the context of any user who views the compromised page, potentially leading to session hijacking or other client-side attacks. The vulnerability is classified under CWE-87 (Improper Neutralization of Alternate XSS Syntax) and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or official remediation has been published yet.

An attacker with Contributor-level or higher access can store malicious scripts in page content that execute in the browsers of users who visit those pages. This can lead to theft of user credentials, session tokens, or other sensitive information accessible via the browser. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions. Since the exploit requires authenticated access, the risk is limited to environments where such user roles exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider additional input validation or content filtering plugins to mitigate risk. Monitor updates from the Elementor vendor for an official patch or temporary workaround.