Stored Cross-Site Scripting in Borderless Elementor Addons and Templates Plugin

CVE-2025-5290

What is CVE-2025-5290?

The Borderless – Elementor Addons and Templates plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability that allows authenticated users, with Contributor-level access or higher, to inject malicious scripts into the ‘title’ parameter. This weakness arises from inadequate input sanitization and output escaping, potentially enabling attackers to execute arbitrary scripts when unsuspecting users access compromised pages. The risk exists in all plugin versions up to and including 1.7.1, emphasizing the critical need for users to ensure their installations are updated to avoid exploitation.

References