Stored Cross-Site Scripting in Element Pack Addons for Elementor by BDThemes
CVE-2025-1457
6.4MEDIUM
Key Information:
- Vendor
- WordPress
- Vendor
- CVE Published:
- 19 April 2025
Summary
The Element Pack Addons for Elementor plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in its Wrapper Link, Countdown, and Gallery widgets. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious scripts into pages, which can execute whenever users visit the affected page. All versions up to and including 5.10.28 are impacted, making it crucial for users to update their plugin to mitigate potential security risks.
Affected Version(s)
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder * <= 5.10.28
References
CVSS V3.1
Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Craig Smith