CVE-2025-14274

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versions up to 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/functions.class.php#L2859
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_params_processor.class.php#L1518
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3429507%40unlimited-elements-for-elementor%2Ftrunk&old=3403331%40unlimited-elements-for-elementor%2Ftrunk&sfp_email=&sfph_mail=#file15
• https://www.wordfence.com/threat-intel/vulnerabilities/id/482c4986-3677-4754-992b-ea9be7573d2e?source=cve

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14268Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-1427A maliciously crafted CATPRODUCT file, when parsed through A…7.8
• CVE-2025-14270The OneClick Chat to Order plugin for WordPress is vulnerabl…2.7
• CVE-2025-14271Rejected reason: This CVE ID has been withdrawn by its CVE N…
• CVE-2025-14272A security issue was identified in Pavilion due to improper …8.3
• CVE-2025-14273Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.1…8.3
• CVE-2025-14275The Jeg Elementor Kit plugin for WordPress is vulnerable to …6.4
• CVE-2025-14276A vulnerability was determined in Ilevia EVE X1 Server up to…5.6
• CVE-2025-14277The Prime Slider – Addons for Elementor plugin for WordPress…4.3
• CVE-2025-14278The HT Slider for Elementor plugin for WordPress is vulnerab…6.4
• CVE-2025-14279MLFlow versions up to and including 3.4.0 are vulnerable to …8.1
• CVE-2025-1428A maliciously crafted CATPART file, when parsed through Auto…7.8