Stored Cross-Site Scripting in Plus Addons for Elementor by WordPress

CVE-2025-7646

What is CVE-2025-7646?

The Plus Addons for Elementor plugin, utilized in WordPress environments, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This occurs through the custom script parameter, allowing authenticated attackers—specifically those with Contributor-level access or above—to inject malicious web scripts. These scripts can execute on any page where they have been injected, posing significant threats to user safety and data integrity, even if the user lacks unfiltered_html capability. This vulnerability impacts all versions leading up to and including 6.3.10.

References