Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor by WordPress

CVE-2025-4944

What is CVE-2025-4944?

The LA-Studio Element Kit for Elementor plugin for WordPress is at risk due to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping on user-supplied data within the plugin's Image Compare and Google Maps widgets. Authenticated users with contributor-level access can exploit this weakness by injecting malicious web scripts into pages. When other users visit these compromised pages, the scripts are executed, potentially allowing attackers to carry out a range of harmful actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References