Stored Cross-Site Scripting Vulnerability in PowerPack Elementor Addons Plugin by WordPress
CVE-2025-8388
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 10 September 2025
What is CVE-2025-8388?
The PowerPack Elementor Addons plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability that arises from inadequate input validation in the 'cursor_url' parameter. This issue impacts all versions up to and including 2.9.4, enabling authenticated users with Contributor-level access and above to inject malicious web scripts into web pages. Such scripts execute whenever an unsuspecting user visits the altered page, creating potential security risks and compromising the integrity of the site.
Affected Version(s)
PowerPack Elementor Addons (Free Widgets, Extensions and Templates) * <= 2.9.4