CVE-2025-1457: Element Pack Elementor Plugin XSS Vulnerability

CVE-2025-1457 Overview

CVE-2025-1457 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Element Pack Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 5.10.28 and resides in the Wrapper Link, Countdown, and Gallery widgets. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript into pages. Injected scripts execute in the browser of any user who views the affected page.

Critical Impact
Authenticated contributors can persist malicious JavaScript that executes in visitor browsers, enabling session theft, redirection, and administrative account compromise through action forgery.

Affected Products

Element Pack Addons for Elementor (bdthemes-element-pack-lite) versions ≤ 5.10.28
WordPress sites running the affected plugin with Contributor+ accounts
Pages rendered with vulnerable Wrapper Link, Countdown, or Gallery widgets

Discovery Timeline

2025-04-19 - CVE-2025-1457 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1457

Vulnerability Analysis

The vulnerability is a stored XSS issue in three Elementor widgets shipped by the plugin. When a Contributor or higher-privileged user configures a Wrapper Link, Countdown, or Gallery widget, attacker-controlled attribute values pass through the widget render path without adequate sanitization. The stored payload is then written back into page output without proper escaping.

Because the payload persists in post or page metadata, every subsequent view of the affected page triggers script execution in the visitor's browser. When an administrator loads the page, the attacker gains the ability to perform actions in the admin session context, including creating new privileged accounts or altering site content.

Root Cause

The plugin's widget rendering logic fails to sanitize input on save and does not apply WordPress escaping functions such as esc_attr() or esc_url() on output. Contributor-level users can therefore submit values containing script tags, event handlers, or javascript: URIs that survive into the rendered HTML. The plugin changesets referenced by the vendor add the missing escaping to the affected widget templates and companion module scripts ep-countdown.min.js and ep-wrapper-link.min.js.

Attack Vector

Exploitation requires an authenticated account with the Contributor role or higher, which is commonly available on multi-author WordPress sites and open registration blogs. The attacker edits a post that uses one of the vulnerable widgets and supplies a crafted attribute containing JavaScript. Once the post is published or previewed, any visitor loading the page triggers the payload. The scope-changed impact means script execution occurs in the context of any user viewing the content, including administrators. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-1457

Indicators of Compromise

Post or page content containing <script> tags, onerror=, onload=, or javascript: URIs within Element Pack widget attributes
Unexpected administrator or editor accounts created shortly after Contributor activity
Outbound requests from admin browser sessions to unfamiliar domains after viewing plugin-rendered pages
Modifications to wp_options or theme files following Contributor logins

Detection Strategies

Query the wp_posts table for Element Pack widget shortcodes containing HTML event handlers or script fragments
Review plugin version data against the fixed release; flag any site running Element Pack Addons for Elementor ≤ 5.10.28
Enable Content Security Policy (CSP) reporting to surface inline script violations on pages using the plugin

Monitoring Recommendations

Audit Contributor and Author account activity, focusing on post revisions that add or modify Wrapper Link, Countdown, or Gallery widgets
Alert on WordPress role changes and new administrator account creation events
Monitor web server logs for anomalous requests originating from authenticated admin sessions after page views

How to Mitigate CVE-2025-1457

Immediate Actions Required

Update Element Pack Addons for Elementor to a version later than 5.10.28 that includes the vendor changeset fix
Audit existing pages built with the affected widgets for injected scripts and remove malicious payloads
Review all Contributor and Author accounts, remove unused accounts, and rotate credentials for accounts with recent widget activity

Patch Information

The vendor addressed the issue in a subsequent release, applying proper output escaping to the Wrapper Link, Countdown, and Gallery widget templates. Refer to the WordPress Element Pack Lite Changeset for the applied fixes to the affected module scripts.

Workarounds

Restrict the Contributor role or require Editor approval before publishing posts that use Element Pack widgets
Deploy a Web Application Firewall (WAF) rule to block script tags and event handlers in plugin-specific request parameters
Apply a strict Content Security Policy that disallows inline JavaScript on the public site
Temporarily disable the Wrapper Link, Countdown, and Gallery widgets if patching is delayed

bash

# Configuration example - identify vulnerable installations via WP-CLI
wp plugin list --name=bdthemes-element-pack-lite --fields=name,status,version
wp plugin update bdthemes-element-pack-lite