Stored Cross-Site Scripting in Royal Elementor Addons for WordPress

CVE-2025-6251

What is CVE-2025-6251?

The Royal Elementor Addons and Templates plugin for WordPress contains a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping. This flaw allows authenticated attackers with Contributor-level access or higher to inject malicious scripts into web pages. When these compromised pages are accessed by users, the injected scripts are executed within their browsers, potentially leading to data theft, session hijacking, and other security breaches.

References