Stored Cross-Site Scripting in ElementsKit Elementor Addons and Templates for WordPress

CVE-2025-3614

What is CVE-2025-3614?

The ElementsKit Elementor Addons and Templates plugin for WordPress contains a vulnerability that allows authenticated users, with Contributor-level access and above, to exploit insufficient input sanitization. By manipulating the URL attribute of a custom widget, attackers can inject arbitrary web scripts, which will execute whenever a user accesses the compromised page. This poses significant risks as it can lead to unauthorized actions being performed on behalf of users, data theft, or the spread of malware.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References