CVE-2025-22323: Elementor Image Hover Effects XSS Flaw

CVE-2025-22323 Overview

CVE-2025-22323 is a stored cross-site scripting (XSS) vulnerability in the Image Hover Effects for Elementor WordPress plugin developed by Liton Arefin. The flaw affects all versions of the image-hover-effects-elementor-addon plugin up to and including version 1.0.2.4. An authenticated attacker with contributor-level access or higher can inject malicious JavaScript that persists in the database and executes in the browsers of site visitors and administrators. The issue is classified under CWE-79, covering improper neutralization of input during web page generation.

Critical Impact
Stored JavaScript payloads execute in the context of any user viewing an affected page, enabling session theft, administrative account takeover, and site defacement.

Affected Products

Liton Arefin Image Hover Effects for Elementor (image-hover-effects-elementor-addon)
All plugin versions from initial release through 1.0.2.4
WordPress installations running Elementor with this addon enabled

Discovery Timeline

2025-01-07 - CVE CVE-2025-22323 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22323

Vulnerability Analysis

The plugin fails to sanitize user-supplied input before storing it and rendering it back within page markup. When a contributor or editor configures an image hover effect through the Elementor widget, attacker-controlled attributes such as titles, captions, or link fields are written to the database without escaping. WordPress subsequently outputs these values into the DOM verbatim, allowing embedded <script> tags or event handlers to execute.

The vulnerability affects the confidentiality, integrity, and availability of the site because injected scripts run with the privileges of the viewer. When an administrator visits an affected page, the payload can perform actions on their behalf, including creating new admin accounts, modifying content, or exfiltrating cookies. The scope change under the CVSS vector reflects that impact extends beyond the plugin to the entire WordPress site.

Root Cause

The root cause is missing output encoding on widget attributes stored via the Elementor editor interface. Developers relied on Elementor's editor UI as an input boundary rather than applying esc_attr(), esc_html(), or wp_kses_post() at render time. This assumption breaks when lower-privileged roles with edit_posts capability supply crafted values.

Attack Vector

An authenticated user with content editing privileges submits a crafted string containing JavaScript in a hover effect field. The payload persists in the WordPress postmeta table. When any visitor loads the page containing the widget, the browser parses the injected script and executes it in the site origin. See the Patchstack XSS Vulnerability Report for the disclosure details.

Detection Methods for CVE-2025-22323

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or javascript: URIs stored in Elementor widget metadata for Image Hover Effects components
New WordPress administrator accounts created shortly after content edits by contributor or editor roles
Outbound requests from visitor browsers to unfamiliar domains sourced from affected pages

Detection Strategies

Audit the wp_postmeta table for entries containing _elementor_data values with script tags or event handler attributes
Review WordPress user activity logs for unusual widget edits by low-privileged accounts
Inspect rendered HTML of pages using Image Hover Effects widgets for unescaped user input

Monitoring Recommendations

Deploy a web application firewall rule to flag POST requests to admin-ajax.php containing script payloads targeting Elementor endpoints
Enable file integrity monitoring on the wp-content/plugins/image-hover-effects-elementor-addon/ directory
Log and alert on admin account creation events and role escalations

How to Mitigate CVE-2025-22323

Immediate Actions Required

Update the Image Hover Effects for Elementor plugin to a version later than 1.0.2.4 as soon as a patched release is available
Restrict contributor and editor role assignments until the plugin is patched
Scan existing content for injected scripts and remove any malicious payloads from the database

Patch Information

At the time of publication, the vendor advisory referenced through Patchstack lists versions through 1.0.2.4 as affected. Administrators should monitor the WordPress plugin repository for a fixed release and apply it immediately once published.

Workarounds

Disable and remove the Image Hover Effects for Elementor plugin until a patched version is released
Apply a Content Security Policy (CSP) that blocks inline scripts to reduce exploitation impact
Configure a WAF rule set that filters XSS payloads on WordPress admin and front-end requests

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate image-hover-effects-elementor-addon
wp plugin delete image-hover-effects-elementor-addon

# Search postmeta for suspicious script content
wp db query "SELECT post_id, meta_key FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%';"