CVE-2025-1455: Royal Elementor Addons XSS Vulnerability

CVE-2025-1455 Overview

CVE-2025-1455 is a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Elementor Addons and Templates plugin for WordPress. The flaw exists in the Woo Grid widget across all versions up to and including 1.7.1012. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript into rendered pages. The payload executes in the browser of any visitor who loads the affected page. The issue is tracked as [CWE-79] and was patched in version 1.7.1013.

Critical Impact
Authenticated contributors can persist arbitrary scripts that execute in visitor browsers, enabling session theft, forced redirects, and administrative account compromise through targeted payloads.

Affected Products

Royal Elementor Addons and Templates plugin for WordPress, versions <= 1.7.1012
Vulnerable component: modules/woo-grid/widgets/wpr-woo-grid.php
Fixed version: 1.7.1013

Discovery Timeline

2025-04-12 - CVE-2025-1455 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1455

Vulnerability Analysis

The vulnerability resides in the Woo Grid widget of the Royal Elementor Addons and Templates plugin. The widget accepts user-controlled parameters that are stored in post meta and later rendered into the DOM without proper sanitization or escaping. Because Elementor widgets serialize their settings and re-render them on page load, injected script content persists across sessions and executes for every viewer of the affected page.

Exploitation requires an account with Contributor privileges or above, which lowers the barrier substantially on multi-author WordPress sites, membership platforms, and any deployment that allows guest posting. User interaction is required only in the sense that a victim must load the injected page. A successful attack can hijack authenticated administrator sessions, plant backdoor accounts, or redirect users to attacker-controlled infrastructure.

Root Cause

The underlying defect is missing input sanitization on widget attributes and missing output escaping when those attributes are echoed into HTML. The vulnerable code path is located in wpr-woo-grid.php at approximately line 9280 in the pre-patch source. The plugin relied on Elementor's control layer to validate content, but the affected fields accept raw markup and are emitted without wrapping through esc_html(), esc_attr(), or wp_kses_post().

Attack Vector

An authenticated Contributor edits or creates a page containing the Woo Grid widget and supplies a crafted string containing HTML and JavaScript in one of the unsanitized fields. Once the page is saved and later rendered, the browser parses the injected markup and executes the attacker's script in the context of the site's origin. The stored nature of the payload makes it reusable and increases the probability of striking a privileged victim such as an editor or administrator reviewing pending content.

No verified public proof-of-concept has been released. See the Wordfence Vulnerability Report and the WordPress Plugin Code Inspection for technical details.

Detection Methods for CVE-2025-1455

Indicators of Compromise

Elementor page or post meta containing <script>, onerror=, onload=, javascript:, or encoded equivalents within Woo Grid widget settings.
Unexpected outbound requests from visitor browsers to unfamiliar domains sourced from pages using the Woo Grid widget.
New administrator accounts, modified user roles, or plugin installs occurring shortly after a Contributor edits a page.
Anomalous entries in the wp_posts and wp_postmeta tables tied to royal-elementor-addons widget IDs.

Detection Strategies

Query wp_postmeta for _elementor_data values containing script tags, event handlers, or wpr-woo-grid widget entries with suspicious character sequences.
Deploy a web application firewall rule that inspects rendered pages for script content originating from post content authored by non-administrative roles.
Correlate WordPress audit logs showing post edits by Contributor accounts with subsequent privilege changes or session anomalies.

Monitoring Recommendations

Enable a WordPress activity logging plugin to track content edits, role changes, and plugin activity by low-privilege users.
Monitor HTTP response bodies through a reverse proxy or WAF for inline scripts on pages that should contain only static product grid markup.
Alert on any addition of administrator or editor role assignments within 24 hours of Contributor content submissions.

How to Mitigate CVE-2025-1455

Immediate Actions Required

Update Royal Elementor Addons and Templates to version 1.7.1013 or later on all WordPress installations.
Audit existing pages that use the Woo Grid widget for injected markup, particularly those authored by Contributor-level accounts.
Review all user accounts with Contributor privileges or higher and disable any that are inactive or unrecognized.
Rotate administrator session cookies and force password resets if injection is confirmed.

Patch Information

The vendor released the fix in version 1.7.1013. The patch adds sanitization and escaping to the affected Woo Grid widget rendering path. Review the diff in the WordPress Change Log Entry to confirm the fixed function paths.

Workarounds

Temporarily disable the Royal Elementor Addons and Templates plugin if immediate patching is not possible.
Restrict Contributor and Author accounts from using Elementor editing capabilities through role management plugins.
Deploy a WAF rule that strips <script> tags and JavaScript event handlers from POST bodies targeting admin-ajax.php and Elementor save endpoints.

bash

# Verify the installed plugin version using WP-CLI
wp plugin get royal-elementor-addons --field=version

# Update to the patched release
wp plugin update royal-elementor-addons --version=1.7.1013

# List users with Contributor or higher privileges for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered