Stored Cross-Site Scripting Vulnerability in Element Pack Addons for Elementor
CVE-2025-1458
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 April 2025
What is CVE-2025-1458?
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to stored cross-site scripting due to inadequate input validation and output escaping. This vulnerability affects multiple widgets, including Dual Button and Creative Button, allowing attackers with Contributor-level access and above to insert arbitrary scripts into pages. When these pages are accessed by other users, the injected scripts execute, potentially compromising user data and security.
Affected Version(s)
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder * <= 5.10.29