Stored Cross-Site Scripting in Anber Elementor Addon for WordPress by Anber

CVE-2025-7440

What is CVE-2025-7440?

The Anber Elementor Addon plugin for WordPress is susceptible to stored cross-site scripting due to a lack of proper input validation and output escaping in the '$item['button_link']['url']' parameter. This vulnerability allows authenticated attackers with Contributor-level access or higher to insert malicious web scripts that will execute when users visit infected pages. As a result, it poses significant risks, including data theft and session hijacking for affected users.

References