DOM-Based Stored Cross-Site Scripting in Essential Addons for Elementor Plugin

CVE-2025-8451

What is CVE-2025-8451?

The Essential Addons for Elementor plugin for WordPress has a vulnerability that allows authenticated contributors and higher to exploit it through DOM-Based Stored Cross-Site Scripting. By manipulating the 'data-gallery-items' parameter, attackers can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page, leading to potential data theft or session hijacking due to insufficient input sanitization and output escaping measures. It is crucial for users of affected versions to update their plugins to mitigate this risk.

References