Stored Cross-Site Scripting Vulnerability in Element Pack Addons for Elementor
CVE-2025-1458

5.4MEDIUM

Key Information:

Vendor
WordPress
Status
Element Pack Addons For Elementor – Best Elementor Addons With Ready Templates, Blocks, Widgets And WooCommerce Builder
Vendor
CVE Published:
26 April 2025

Summary

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to stored cross-site scripting due to inadequate input validation and output escaping. This vulnerability affects multiple widgets, including Dual Button and Creative Button, allowing attackers with Contributor-level access and above to insert arbitrary scripts into pages. When these pages are accessed by other users, the injected scripts execute, potentially compromising user data and security.

Affected Version(s)

Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder * <= 5.10.29

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D.Sim
.
CVE-2025-1458 : Stored Cross-Site Scripting Vulnerability in Element Pack Addons for Elementor | SecurityVulnerability.io