Stored Cross-Site Scripting in Addon Elements for Elementor Plugin by WordPress
CVE-2025-12537
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 December 2025
What is CVE-2025-12537?
The Addon Elements for Elementor plugin for WordPress has a vulnerability that allows authenticated users with Contributor-level access and above to exploit insufficient input sanitization and output escaping. By injecting arbitrary web scripts through various widget parameters, these scripts can be executed whenever a user accesses the compromised page, resulting in potential data theft or session hijacking.
Affected Version(s)
Addon Elements for Elementor (formerly Elementor Addon Elements) * <= 1.14.3