CVE-2025-1458: Element Pack for Elementor XSS Vulnerability

CVE-2025-1458 Overview

CVE-2025-1458 is a Stored Cross-Site Scripting (XSS) vulnerability in the Element Pack Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 5.10.29 and resides in several widgets, including Dual Button, Creative Button, and Image Stack. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who visits an affected page. The vulnerability is tracked under [CWE-79].

Critical Impact
Authenticated contributors can store malicious JavaScript in Elementor pages, enabling session hijacking, redirection, or privilege escalation when administrators view the content.

Affected Products

bdthemes Element Pack Addons for Elementor (Lite) — all versions up to and including 5.10.29
WordPress sites running the plugin with Contributor-level accounts or higher
Pages built with Dual Button, Creative Button, Image Stack, and other affected widgets

Discovery Timeline

2025-04-26 - CVE-2025-1458 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1458

Vulnerability Analysis

The Element Pack Addons for Elementor plugin processes widget attributes supplied by authors through the Elementor page builder interface. Several widgets accept text, URL, or HTML attributes that are rendered directly into page markup without proper escaping. An authenticated user with Contributor privileges can craft widget parameters containing JavaScript payloads. When the resulting page is rendered, the browser executes the attacker-controlled script in the context of the site's origin. The attack requires user interaction, since a victim must view the page containing the injected widget. The scope is changed because the executed script runs in a different security context than the attacker's own account.

Root Cause

The vulnerability stems from missing input sanitization on widget attributes and missing output escaping when those attributes are rendered. Functions such as wp_kses_post() or esc_attr() are either absent or incorrectly applied to attributes handled by the Dual Button, Creative Button, Image Stack, and additional widgets. Contributor-level users can supply raw HTML and JavaScript that persists in the WordPress database and is reflected into rendered pages.

Attack Vector

Exploitation is network-based and requires an authenticated account with Contributor-level privileges. The attacker edits an Elementor page, adds one of the affected widgets, and places a JavaScript payload inside an attribute field such as a button label or link. The payload is saved to the database as part of the Elementor data structure. When any visitor — including administrators — views the published or preview page, the script executes. Attackers can use this to steal session cookies, perform actions on behalf of administrators, redirect users, or deliver secondary payloads.

No verified public proof-of-concept code is available. Technical details are documented in the Wordfence Vulnerability Report and the WordPress Plugin Changeset.

Detection Methods for CVE-2025-1458

Indicators of Compromise

Elementor widget data in wp_postmeta containing <script> tags, javascript: URIs, or event handlers like onerror= and onclick=
Unexpected outbound requests from administrator browser sessions after viewing contributor-authored pages
New or modified posts authored by Contributor accounts that include Dual Button, Creative Button, or Image Stack widgets
Administrator account changes or new users created immediately after page previews

Detection Strategies

Query the WordPress database for suspicious strings in _elementor_data postmeta entries
Review audit logs for Contributor-level users adding or editing pages that use the affected widgets
Deploy a web application firewall rule to flag HTTP POST requests to admin-ajax.php or the REST API containing script payloads in Elementor widget fields

Monitoring Recommendations

Monitor WordPress user role assignments and alert on any elevation to Contributor or higher
Log and review Elementor save operations, especially from non-administrator roles
Enable Content Security Policy (CSP) reporting to detect inline script execution violations on public pages

How to Mitigate CVE-2025-1458

Immediate Actions Required

Update the Element Pack Addons for Elementor plugin to a version later than 5.10.29
Audit existing pages authored by Contributor-level users for malicious widget content
Temporarily restrict Contributor accounts from publishing or previewing pages until patched
Rotate administrator session cookies and credentials if suspicious widget content is discovered

Patch Information

The vendor addressed the vulnerability in a release following 5.10.29. Refer to the WordPress Plugin Changeset for the corrective commit and the Wordfence Vulnerability Report for fixed-version details.

Workarounds

Disable the Element Pack Addons for Elementor plugin until the patched version is deployed
Remove or demote Contributor accounts that are not actively required
Deploy a web application firewall with rules blocking script payloads in Elementor widget parameters
Enforce a strict Content Security Policy that disallows inline scripts on front-end pages

bash

# Update the plugin via WP-CLI once a patched release is available
wp plugin update bdthemes-element-pack-lite

# Verify installed version is greater than 5.10.29
wp plugin get bdthemes-element-pack-lite --field=version

# List users with Contributor role or higher for review
wp user list --role=contributor --fields=ID,user_login,user_email