Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor by WordPress

CVE-2025-4944

What is CVE-2025-4944?

The LA-Studio Element Kit for Elementor plugin for WordPress is at risk due to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping on user-supplied data within the plugin's Image Compare and Google Maps widgets. Authenticated users with contributor-level access can exploit this weakness by injecting malicious web scripts into pages. When other users visit these compromised pages, the scripts are executed, potentially allowing attackers to carry out a range of harmful actions.

References