Stored Cross-Site Scripting in Element Pack Addons for Elementor Plugin

CVE-2025-5944

What is CVE-2025-5944?

The Element Pack Addons for Elementor plugin is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the ‘data-caption’ attribute. Authenticated attackers, with Contributor-level access or higher, can exploit this vulnerability to inject arbitrary scripts on pages. When a user visits an affected page, these scripts execute, leading to potential data theft or further exploitation.

References