Stored Cross-Site Scripting Vulnerability in Unlimited Elements For Elementor Plugin

CVE-2025-1663

What is CVE-2025-1663?

The Unlimited Elements For Elementor plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or higher to perform Stored Cross-Site Scripting (XSS) attacks. This flaw arises from inadequate input sanitization and output escaping in several widgets, enabling attackers to inject arbitrary scripts into pages. Once a user accesses an affected page, the injected scripts execute, potentially compromising user sessions and data.

References