CVE-2025-13196: Element Pack Elementor Plugin XSS Vulnerability

CVE-2025-13196 Overview

CVE-2025-13196 is a stored Cross-Site Scripting (XSS) vulnerability in the Element Pack Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 8.3.4. The Open Street Map widget fails to sanitize the marker content parameter before rendering, allowing authenticated users with Contributor-level access or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any visitor who loads the affected page. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persistently inject JavaScript that executes against administrators and site visitors, enabling session theft, account takeover, and further compromise of the WordPress site.

Affected Products

Element Pack Addons for Elementor (WordPress plugin) — all versions ≤ 8.3.4
WordPress sites using the vulnerable Open Street Map widget
Multi-author WordPress deployments granting Contributor or higher roles

Discovery Timeline

2025-11-18 - CVE-2025-13196 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-13196

Vulnerability Analysis

The vulnerability resides in the Open Street Map widget shipped with Element Pack Addons for Elementor. The widget accepts user-supplied marker content that is stored as part of the Elementor page configuration. When the widget's render function outputs marker attributes into the page, it does not apply adequate sanitization or output escaping. As a result, HTML and JavaScript payloads submitted through the marker content parameter are preserved verbatim and injected into the rendered DOM.

Because the payload is persisted with the page and executes for every subsequent visitor, this is a stored (persistent) XSS rather than a reflected one. Contributor accounts are commonly provisioned on multi-author blogs and community sites, which broadens the practical attack surface.

Root Cause

The render path for the Open Street Map widget concatenates attacker-controlled marker content into HTML output without invoking WordPress escaping primitives such as esc_html(), esc_attr(), or wp_kses_post(). The absence of input sanitization on save combined with missing output escaping on render produces the classic stored XSS condition described in CWE-79.

Attack Vector

An authenticated attacker with at least Contributor privileges creates or edits a page containing the Open Street Map widget. The attacker sets the marker content field to a payload containing script tags or HTML event handlers. Once the page is published or previewed by a higher-privileged user, the browser parses and executes the payload in the site's origin. This can be leveraged to steal administrator session cookies, exfiltrate nonces, submit privileged AJAX requests, or plant a backdoor plugin.

No verified public proof-of-concept exploit code is published for this issue. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the patched source diff.

Detection Methods for CVE-2025-13196

Indicators of Compromise

Elementor page metadata (_elementor_data in wp_postmeta) containing <script>, onerror=, onload=, or javascript: sequences within Open Street Map widget marker fields.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading edited pages.
New administrator accounts, modified user roles, or unknown plugins installed after a Contributor edited a page containing the map widget.

Detection Strategies

Query the WordPress database for element_pack_open_street_map widget entries and inspect marker content for HTML or JavaScript tokens.
Monitor WordPress audit logs for page edits by Contributor accounts that include the Open Street Map widget.
Deploy a Web Application Firewall (WAF) ruleset that inspects Elementor save requests for script payloads in widget attributes.

Monitoring Recommendations

Alert on Content Security Policy (CSP) violations reported by administrator sessions, which often surface stored XSS execution.
Track privilege changes and plugin installations correlated with recent Contributor activity.
Review web server access logs for POST requests to admin-ajax.php containing action=elementor_ajax from low-privilege users.

How to Mitigate CVE-2025-13196

Immediate Actions Required

Update Element Pack Addons for Elementor to the version released after 8.3.4 that contains the fix documented in the WordPress Plugin Changeset.
Audit all pages using the Open Street Map widget for suspicious marker content and remove any injected scripts.
Rotate administrator passwords and invalidate active sessions if evidence of exploitation is found.

Patch Information

The vendor addressed the issue in the plugin changeset referenced above, which introduces proper escaping on the marker content attribute before render. Site owners should apply the update through the WordPress plugin dashboard or by deploying the patched package. Confirm the installed version reports higher than 8.3.4 after upgrade.

Workarounds

Restrict Contributor and Author roles from editing pages that contain the Open Street Map widget until the plugin is patched.
Temporarily deactivate Element Pack Addons for Elementor on sites that cannot patch immediately.
Enforce a strict Content Security Policy that blocks inline scripts to reduce the impact of stored XSS payloads.

bash

# Verify installed plugin version and update via WP-CLI
wp plugin get bdthemes-element-pack-lite --field=version
wp plugin update bdthemes-element-pack-lite
wp plugin get bdthemes-element-pack-lite --field=version