CVE-2025-11220: Elementor WordPress Plugin XSS Vulnerability

CVE-2025-11220 Overview

CVE-2025-11220 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor plugin for WordPress. The flaw exists in the plugin's Text Path widget across all versions up to and including 3.33.3. The plugin fails to properly neutralize user-supplied input used to build Scalable Vector Graphics (SVG) markup inside the widget. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when other users, including administrators, view the affected page. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that runs in the browser context of any visitor, enabling session theft, administrative account takeover, and site defacement.

Affected Products

Elementor plugin for WordPress, all versions up to and including 3.33.3
WordPress sites using the Text Path widget feature
Sites permitting contributor-level or higher registration

Discovery Timeline

2025-12-16 - CVE-2025-11220 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11220

Vulnerability Analysis

The Text Path widget in Elementor renders text along a custom SVG path. The widget accepts user-supplied values that are concatenated directly into SVG markup rendered on the page. Because the plugin does not sufficiently escape or sanitize these inputs, an attacker can break out of the intended SVG attribute context and introduce arbitrary HTML or JavaScript.

Stored XSS in a page-builder widget is particularly effective because the payload is saved to the WordPress database and rendered on every page view. The injected script executes in the browser context of any authenticated user who loads the affected page, including administrators previewing contributor submissions.

Exploitation requires only contributor-level access, a privilege tier that many WordPress sites grant to unvetted registered users, guest authors, or third-party contributors.

Root Cause

The root cause is insufficient neutralization of user input during SVG markup generation inside the Text Path widget. The widget trusts editor-supplied values when constructing SVG <text>, <textPath>, and related elements. Because SVG is an XML dialect that natively supports scripting through elements such as <script> and event-handler attributes, unsanitized input placed inside SVG markup can be parsed and executed by the browser.

Attack Vector

An authenticated attacker with contributor privileges edits or creates a page that includes the Elementor Text Path widget. The attacker supplies a crafted string containing SVG- or HTML-context-breaking characters and a JavaScript payload. When the page is saved and later rendered — either through preview, editorial review, or after publication — the payload executes in the visitor's browser under the site's origin.

Typical impact includes theft of authenticated session cookies, forced actions performed by administrator sessions such as creating new admin accounts, and redirection or defacement of site content.

No verified proof-of-concept code is published in the referenced advisories. For technical details, see the Wordfence Vulnerability Report and the WordPress Changeset Update.

Detection Methods for CVE-2025-11220

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored inside Elementor Text Path widget content within the wp_postmeta table under the _elementor_data key.
Newly created WordPress administrator accounts following contributor activity on Elementor-authored pages.
Outbound requests from browsers viewing published pages to unfamiliar external domains hosting JavaScript payloads.

Detection Strategies

Query the WordPress database for Text Path widget entries containing suspicious characters such as <script, onerror=, onload=, or href="javascript: within Elementor JSON data structures.
Monitor web server access logs for POST requests to /wp-admin/admin-ajax.php with the elementor_ajax action originating from contributor accounts.
Deploy a web application firewall (WAF) rule set that identifies XSS payloads submitted through Elementor editor endpoints.

Monitoring Recommendations

Alert on privilege changes, particularly promotion of contributor accounts to editor or administrator roles.
Track content revisions on Elementor-built pages and flag revisions authored by low-privilege users that add Text Path widget elements.
Enforce Content Security Policy (CSP) headers and log CSP violation reports to identify inline-script execution attempts on production pages.

How to Mitigate CVE-2025-11220

Immediate Actions Required

Update the Elementor plugin to the version published after the fix in WordPress plugin changeset 3414494.
Audit all contributor, author, and editor accounts and remove any that are unrecognized or inactive.
Review pages built with the Text Path widget for injected script content and revert or purge affected revisions.

Patch Information

Elementor addressed the vulnerability in the release following version 3.33.3. The fix is committed in WordPress plugin changeset 3414494, which adds neutralization of user-supplied input before it is written into SVG markup. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Restrict contributor and higher access to trusted users only until the patch is applied.
Disable the Text Path widget through Elementor's widget management interface if the update cannot be installed immediately.
Deploy a WAF policy that blocks HTML tag characters and JavaScript event-handler patterns in Elementor editor requests submitted by non-administrator roles.

bash

# Update Elementor via WP-CLI
wp plugin update elementor

# Verify installed version is greater than 3.33.3
wp plugin get elementor --field=version