Stored Cross-Site Scripting in PowerPack Elementor Addons Plugin for WordPress

CVE-2025-1512

What is CVE-2025-1512?

The PowerPack Elementor Addons plugin for WordPress is susceptible to Stored Cross-Site Scripting via the Custom Cursor Extension in all versions up to and including 2.9.0. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. Such scripts execute in the context of a user who accesses the compromised page, potentially leading to data theft or session hijacking.

References