Stored Cross-Site Scripting in Plus Addons for Elementor by WordPress

CVE-2025-7646

What is CVE-2025-7646?

The Plus Addons for Elementor plugin, utilized in WordPress environments, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This occurs through the custom script parameter, allowing authenticated attackers—specifically those with Contributor-level access or above—to inject malicious web scripts. These scripts can execute on any page where they have been injected, posing significant threats to user safety and data integrity, even if the user lacks unfiltered_html capability. This vulnerability impacts all versions leading up to and including 6.3.10.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References