CVE-2025-13535: King Addons for Elementor XSS Vulnerability

CVE-2025-13535 Overview

The King Addons for Elementor plugin for WordPress contains multiple DOM-Based Stored Cross-Site Scripting (XSS) vulnerabilities affecting all versions up to and including 51.1.38. These vulnerabilities stem from insufficient input sanitization and output escaping across multiple widgets and features within the plugin. Authenticated attackers with Contributor-level access or above can exploit these flaws to inject arbitrary web scripts that execute when users access the compromised page or when administrators preview the content in Elementor's editor.

Critical Impact

Authenticated attackers with minimal privileges (Contributor-level) can inject persistent malicious scripts across multiple plugin widgets, potentially leading to session hijacking, credential theft, and privilege escalation when administrators interact with infected pages.

Affected Products

• King Addons for Elementor plugin for WordPress versions up to and including 51.1.38
• WordPress installations using the affected King Addons plugin with Elementor
• All users with Contributor-level access or higher on affected WordPress sites

Discovery Timeline

• 2026-04-01 - CVE-2025-13535 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-13535

Vulnerability Analysis

This vulnerability represents a classic case of improper output encoding in a context where HTML entity decoding occurs automatically. The plugin developers use esc_attr() and esc_url() functions for sanitization, which are appropriate for HTML attribute contexts but fail to provide adequate protection within JavaScript inline event handlers.

When user-controlled data is placed inside onclick attributes after being processed by these escaping functions, the browser's DOM parsing behavior decodes HTML entities before the JavaScript executes. This allows attackers to craft payloads using HTML entity encoding that bypasses the escaping functions but gets decoded back to executable JavaScript by the browser.

Additionally, several JavaScript files within the plugin employ unsafe DOM manipulation methods including template literals, jQuery's .html() method, and window.location.href assignments with unvalidated URLs. These patterns create injection points where user-controlled data from Elementor widget settings flows into executable contexts without proper sanitization.

The vulnerability affects multiple widgets and features including the Countdown widget, Image Accordion widget, Off Canvas Content, Popup widget, Pricing Calculator, Video Popup, Wrapper Link feature, and the lightgallery library integration.

Root Cause

The root cause lies in a fundamental misunderstanding of browser context switching during HTML parsing. While esc_attr() properly escapes characters for HTML attribute contexts, the browser decodes these entities when parsing the attribute value before passing it to the JavaScript engine. For example, ' becomes a single quote when the onclick handler executes, allowing attackers to break out of string literals within the JavaScript context.

The secondary root cause involves direct use of user-controlled Elementor widget settings in JavaScript code without validation or encoding appropriate for the JavaScript context. Template literal interpolation and jQuery's .html() method both interpret the input as executable content rather than safe text.

Attack Vector

The attack requires an authenticated user with at least Contributor-level privileges on the target WordPress site. The attacker configures malicious payloads within Elementor widget settings for any of the affected widgets. These payloads are designed to either:

1. Use HTML entity encoding to bypass esc_attr() or esc_url() and execute when decoded by the DOM parser
2. Inject JavaScript directly through widget settings that flow into unsafe DOM manipulation methods

The malicious scripts execute in two scenarios: when any visitor loads the page containing the compromised widget, or when an administrator previews the page within the Elementor editor interface. The latter scenario is particularly dangerous as it can lead to administrative session compromise.

Detection Methods for CVE-2025-13535

Indicators of Compromise

• Unusual JavaScript code or HTML entities within Elementor widget settings in the wp_postmeta database table
• Unexpected onclick attribute values containing encoded JavaScript payloads in rendered page HTML
• Contributor-level users creating pages with widgets containing suspicious encoded content
• Browser console errors or unexpected script execution when loading pages with King Addons widgets

Detection Strategies

• Review Elementor widget configurations for HTML entity-encoded payloads, particularly in URL and text fields
• Monitor post metadata changes made by Contributor-level users for suspicious patterns
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Audit access logs for Contributor users accessing sensitive widget settings

Monitoring Recommendations

• Enable WordPress audit logging to track widget configuration changes
• Deploy web application firewall (WAF) rules to detect XSS payload patterns in POST requests to Elementor endpoints
• Monitor for unusual JavaScript execution patterns using client-side security solutions
• Regularly scan WordPress installations for known vulnerable plugin versions

How to Mitigate CVE-2025-13535

Immediate Actions Required

• Update King Addons for Elementor to the latest available version beyond 51.1.38
• Review all pages created by Contributor-level users for potentially malicious widget configurations
• Consider temporarily restricting Contributor access to affected widgets until patch is applied
• Implement Content Security Policy headers to limit inline script execution

Patch Information

The vulnerability was partially patched in version 5.1.51. Two changesets address portions of this vulnerability:

• WordPress Changeset #3438067 contains initial fixes
• WordPress Changeset #3441952 provides additional remediation

For complete details on the vulnerability and patch status, refer to the Wordfence Vulnerability Advisory.

Workarounds

• Restrict Contributor-level user capabilities using a WordPress role management plugin to prevent access to Elementor widget editing
• Implement server-side input validation for Elementor widget settings independent of the plugin's sanitization
• Deploy a web application firewall with XSS protection rules enabled for WordPress admin endpoints
• Consider temporarily disabling the affected widgets (Countdown, Image Accordion, Off Canvas Content, Popup, Pricing Calculator, Video Popup, Wrapper Link) until fully patched

# Restrict contributor access to Elementor editing via wp-config.php
# Add capability restrictions in your theme's functions.php
# Example: Remove 'edit_pages' capability from contributors
# add_filter('map_meta_cap', 'restrict_elementor_editing', 10, 4);