Stored Cross-Site Scripting Vulnerability in Elementor Plugin for WordPress
CVE-2025-11220
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 December 2025
What is CVE-2025-11220?
The Elementor plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access or higher to exploit the plugin's Text Path widget. This vulnerability arises from the insufficient neutralization of user-supplied input used to create SVG markup within the widget. Consequently, attackers can inject arbitrary web scripts that execute whenever users navigate to a page containing the malicious code, posing significant risks to website integrity and user safety.
Affected Version(s)
Elementor Website Builder – More Than Just a Page Builder * <= 3.33.3