CVE-2025-13141: HT Mega Elementor Plugin XSS Vulnerability

CVE-2025-13141 Overview

CVE-2025-13141 is a Stored Cross-Site Scripting (XSS) vulnerability in the HT Mega – Absolute Addons For Elementor plugin for WordPress. The flaw affects all versions up to and including 3.0.0 and stems from insufficient input validation on user-supplied HTML tag names within the plugin's Gutenberg blocks. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users view affected pages. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist malicious scripts inside published content, enabling session theft, administrator account takeover, and drive-by browser attacks against site visitors.

Affected Products

HT Mega – Absolute Addons For Elementor plugin for WordPress
All versions up to and including 3.0.0
WordPress installations using the plugin's Gutenberg blocks

Discovery Timeline

2025-11-21 - CVE-2025-13141 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13141

Vulnerability Analysis

The vulnerability resides in HT Mega's Gutenberg block rendering logic. The plugin accepts an HTML tag name from block attributes and passes it through WordPress's tag_escape() function before emitting it in output markup. While tag_escape() strips invalid tag-name characters, it does not restrict the set of tags an attacker may specify. As a result, dangerous tags such as script, iframe, and object pass through the sanitizer intact.

Some blocks additionally wrap inner content with esc_html(). Attackers bypass this control using JavaScript encoding techniques that do not require quoted string literals, including unquoted attribute values, backtick-delimited template literals, and String.fromCharCode() payload construction. The combination of a permissive tag-name filter and bypassable content escaping allows persistent script injection into published pages.

Root Cause

The root cause is the absence of an allowlist for HTML tag names supplied through block attributes. Sanitization relies solely on tag_escape(), which validates tag-name syntax but does not enforce a safe-tag policy. Compounding this, content escaping via esc_html() is defeated by script payloads that avoid characters the function neutralizes.

Attack Vector

An attacker requires an authenticated Contributor role or higher. The attacker edits a post using the affected HT Mega Gutenberg block and sets the block's tag attribute to a dangerous element such as script. When the post is rendered, the injected element executes in the browser context of every viewer, including administrators. This enables session hijacking, forced administrative actions via CSRF chaining, and redirection to attacker-controlled infrastructure.

Because no verified proof-of-concept code has been published, refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-13141

Indicators of Compromise

Post content or wp_posts.post_content entries containing <script>, <iframe>, or <object> tags originating from HT Mega block markup.
Unexpected outbound requests from visitor browsers to unknown domains loaded from pages rendered with HT Mega blocks.
Contributor or Author accounts creating or editing posts that embed executable HTML through Gutenberg block attributes.

Detection Strategies

Query the WordPress database for HT Mega block comments () whose serialized attributes include tag values other than expected containers such as div, span, h1–h6, or p.
Inspect rendered page HTML for script elements, event handlers, or javascript: URIs generated from plugin block output.
Correlate role-change and post-publication events for Contributor-level accounts to identify abuse patterns.

Monitoring Recommendations

Log and review all post creation and update actions initiated by non-Administrator roles.
Deploy Content Security Policy (CSP) headers in report-only mode to surface unexpected inline script execution on public pages.
Alert on newly registered low-privilege accounts that publish content shortly after registration.

How to Mitigate CVE-2025-13141

Immediate Actions Required

Update the HT Mega – Absolute Addons For Elementor plugin to a version later than 3.0.0 that includes the fix committed in the WordPress Changeset Update.
Audit existing posts and pages for injected <script>, <iframe>, or <object> elements introduced through HT Mega blocks and remove malicious content.
Review Contributor, Author, and Editor accounts for unauthorized additions or suspicious activity.

Patch Information

The vendor addressed the flaw in the plugin update tracked by WordPress Plugin Changeset 3398480. The patch introduces stricter validation on user-supplied tag names within Gutenberg blocks. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Restrict Contributor and higher accounts to trusted users only until the patched version is deployed.
Temporarily disable the HT Mega – Absolute Addons For Elementor plugin on sites where untrusted users hold post-editing privileges.
Enforce a strict Content Security Policy that disallows inline scripts to reduce exploitation impact.

bash

# Update the plugin using WP-CLI
wp plugin update ht-mega-for-elementor

# Verify the installed version is above 3.0.0
wp plugin get ht-mega-for-elementor --field=version