Cross-Site Scripting Vulnerability in StylemixThemes Consulting Elementor Widgets
CVE-2025-64361

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Consulting Elementor Widgets
Vendor
CVE Published:
31 October 2025

What is CVE-2025-64361?

A Cross-Site Scripting (XSS) vulnerability exists in the StylemixThemes Consulting Elementor Widgets plugin, enabling attackers to inject malicious scripts into web pages. This flaw allows for DOM-Based XSS, which could be exploited to access sensitive user data or perform actions on behalf of unsuspecting users. The vulnerability affects versions of Consulting Elementor Widgets up to 1.4.2, making it critical for users of this plugin to implement security measures and ensure their websites are protected against potential attacks.

Affected Version(s)

Consulting Elementor Widgets <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/cons...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
JSON
.