Stored Cross-Site Scripting in Responsive Addons for Elementor by WordPress

CVE-2025-2225

What is CVE-2025-2225?

The Responsive Addons for Elementor plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the 'rael_title_tag' parameter. This issue arises from inadequate input sanitization and output escaping, enabling authenticated users with Contributor-level access or higher to inject malicious scripts into web pages. When such pages are accessed, the injected scripts may execute, potentially compromising user data or site integrity. While this vulnerability was partially mitigated in version 1.6.9, users are encouraged to review and implement best practices for securing their sites.

References