DOM-Based Stored Cross-Site Scripting in Essential Addons for Elementor Plugin

CVE-2025-8451

What is CVE-2025-8451?

The Essential Addons for Elementor plugin for WordPress has a vulnerability that allows authenticated contributors and higher to exploit it through DOM-Based Stored Cross-Site Scripting. By manipulating the 'data-gallery-items' parameter, attackers can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page, leading to potential data theft or session hijacking due to insufficient input sanitization and output escaping measures. It is crucial for users of affected versions to update their plugins to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References