Stored Cross-Site Scripting Vulnerability in Premium Addons for Elementor Plugin by WordPress

CVE-2025-4774

What is CVE-2025-4774?

The Premium Addons for Elementor plugin for WordPress is vulnerable to a Stored Cross-Site Scripting issue through the data-countdown attribute of the Countdown widget, affecting all versions up to 4.11.8. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access and higher to inject arbitrary scripts into pages. These scripts will execute when any user accesses the compromised page, potentially leading to unauthorized actions and data leakage.

References