Stored Cross-Site Scripting Vulnerability in Royal Elementor Addons Plugin for WordPress
CVE-2025-3813

6.4MEDIUM

What is CVE-2025-3813?

The Royal Elementor Addons and Templates plugin for WordPress allows attackers with Contributor-level access or higher to exploit a Stored Cross-Site Scripting vulnerability through the '_elementor_data' parameter. This flaw arises from inadequate input sanitization and output escaping, enabling the injection of malicious web scripts into pages. As a result, these scripts run whenever users visit affected pages, potentially leading to unauthorized actions and data exposure.

Affected Version(s)

Royal Elementor Addons and Templates * <= 1.7.1020

References

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Sans-Souci
.
CVE-2025-3813 : Stored Cross-Site Scripting Vulnerability in Royal Elementor Addons Plugin for WordPress