Stored Cross-Site Scripting Vulnerability in HT Mega – Absolute Addons For Elementor Plugin

CVE-2025-13141

What is CVE-2025-13141?

The HT Mega – Absolute Addons For Elementor plugin for WordPress contains a vulnerability that permits stored Cross-Site Scripting (XSS) via its Gutenberg blocks. This issue arises from inadequate input validation on user-provided HTML tag names leading to the potential injection of harmful scripts, such as 'script', 'iframe', and 'object'. Although the plugin employs tag_escape() for sanitization, it lacks a comprehensive whitelist for tag names. Attackers with contributor-level credentials and above can exploit this vulnerability to inject malicious web scripts, which would execute whenever an affected page is accessed.

References