CVE-2025-1526 is a stored cross-site scripting vulnerability (CWE-79) in the DethemeKit for Elementor WordPress plugin, specifically in the De Product Display Widget's countdown feature. The flaw allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary web scripts due to improper input sanitization and output escaping. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other client-side impacts. The vulnerability affects all versions up to and including 2.1.9. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the countdown feature, which execute in the browsers of users who view those pages. This can lead to partial confidentiality and integrity loss, such as theft of session tokens or unauthorized actions performed on behalf of users. There is no indication of availability impact. The vulnerability requires authenticated access, limiting exploitation scope to users with some level of trust within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or avoiding use of the De Product Display Widget's countdown feature. Monitor for plugin updates from the vendor that address this vulnerability.