Stored Cross-Site Scripting in Themesflat Addons for Elementor Plugin

CVE-2025-3275

What is CVE-2025-3275?

The Themesflat Addons For Elementor plugin for WordPress contains a vulnerability that allows authenticated attackers with Contributor-level access and above to exploit stored cross-site scripting (XSS) flaws. This issue arises from insufficient input sanitization and output escaping in the TF E Slider widget. Attackers can inject malicious web scripts into pages, which execute whenever a user accesses the compromised page, potentially leading to unauthorized actions or data exposure.

References