Stored Cross-Site Scripting in PowerPack Elementor Addons Plugin for WordPress
CVE-2025-1512

6.4MEDIUM

Key Information:

Vendor
WordPress
Status
Powerpack Elementor Addons (free Widgets, Extensions And Templates)
Vendor
CVE Published:
1 April 2025

Summary

The PowerPack Elementor Addons plugin for WordPress is susceptible to Stored Cross-Site Scripting via the Custom Cursor Extension in all versions up to and including 2.9.0. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. Such scripts execute in the context of a user who accesses the compromised page, potentially leading to data theft or session hijacking.

Affected Version(s)

PowerPack Elementor Addons (Free Widgets, Extensions and Templates) * <= 2.9.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3262339/powe...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D.Sim
.