Stored Cross-Site Scripting Vulnerability in Essential Addons for Elementor by WordPress

CVE-2025-13977

What is CVE-2025-13977?

The Essential Addons for Elementor plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability, affecting all versions up to 6.5.3. This flaw arises from inadequate input sanitization and improper output escaping mechanisms within the Event Calendar widget's management of custom attributes, as well as the Image Masking module's handling of element IDs. Authenticated attackers, who hold Contributor-level access or higher, can exploit this weakness to inject malicious web scripts into web pages. These scripts will execute whenever a user visits an affected page, potentially compromising user data and site integrity.

References