Stored Cross-Site Scripting Vulnerability in LA-Studio Element Kit for Elementor
CVE-2025-8360

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
La-studio Element Kit For Elementor
Vendor
CVE Published:
6 September 2025

What is CVE-2025-8360?

The LA-Studio Element Kit for Elementor plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access and above to exploit input sanitization weaknesses. This can lead to the injection of arbitrary web scripts through multiple widgets within the plugin. When a user visits an infected page, these scripts will execute, potentially compromising user data and site integrity. Updating the plugin and implementing proper input validation is essential to mitigate this risk.

Affected Version(s)

LA-Studio Element Kit for Elementor * <= 1.5.5.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D.Sim
.
CVE-2025-8360 : Stored Cross-Site Scripting Vulnerability in LA-Studio Element Kit for Elementor