Elementor Website Builder More Than Just A Page Builder CVE-2025-14732

The CVSS score of 6.4 reflects moderate severity with a network attack vector, low complexity, and low privileges required (Contributor role). However, real-world risk is contextually significant because: (1) WordPress Contributor-level access is commonly granted to content creators and freelancers, widening the attacker pool; (2) the vulnerability affects scope (S:C), meaning the impact crosses security boundaries and affects other users on the site; (3) stored XSS in a page builder affecting all visitors creates persistent, site-wide compromise potential; (4) no exploit code or active exploitation signals (KEV status not provided) reduce immediate threat, but the straightforward nature of the vulnerability and public vulnerability disclosure suggest exploitation is likely inevitable. EPSS probability not provided, but the attack vector (network), low complexity, and authenticated-but-common access level suggest high exploitation likelihood. This is a legitimate priority for WordPress administrators, particularly on multi-user installations.

A site administrator grants a Contributor-level user account to a freelance content creator. The attacker uses the Elementor page builder interface to add a widget and injects malicious JavaScript into a widget parameter (e.g., a custom text field or styling attribute). The script, such as a keylogger or credential stealer, is stored in the WordPress database. When any site visitor (including administrators) accesses the page containing the affected widget, the injected script executes in their browser with the privileges of their WordPress session, enabling account takeover or malware distribution. This requires only the attacker to have Contributor access and the target user to visit the compromised page-no interaction or social engineering is needed.