Stored Cross-Site Scripting in ElementsKit Elementor Addons and Templates for WordPress

CVE-2025-3614

What is CVE-2025-3614?

The ElementsKit Elementor Addons and Templates plugin for WordPress contains a vulnerability that allows authenticated users, with Contributor-level access and above, to exploit insufficient input sanitization. By manipulating the URL attribute of a custom widget, attackers can inject arbitrary web scripts, which will execute whenever a user accesses the compromised page. This poses significant risks as it can lead to unauthorized actions being performed on behalf of users, data theft, or the spread of malware.

References