Stored Cross-Site Scripting in Elementor Website Builder Pro for WordPress

CVE-2025-3076

What is CVE-2025-3076?

The Elementor Website Builder Pro plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability via the 'button_text' parameter. This issue arises from inadequate input sanitization and output escaping, permitting authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute when users visit an affected page, potentially leading to unauthorized actions and data exposure.

References