Stored Cross-Site Scripting Vulnerability in Premium Addons for Elementor Plugin by WordPress

CVE-2025-4774

What is CVE-2025-4774?

The Premium Addons for Elementor plugin for WordPress is vulnerable to a Stored Cross-Site Scripting issue through the data-countdown attribute of the Countdown widget, affecting all versions up to 4.11.8. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access and higher to inject arbitrary scripts into pages. These scripts will execute when any user accesses the compromised page, potentially leading to unauthorized actions and data leakage.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References