CVE-2025-24595: All Embed Elementor Addons XSS Vulnerability

CVE-2025-24595 Overview

CVE-2025-24595 is a stored Cross-Site Scripting (XSS) vulnerability in the bPlugins All Embed – Elementor Addons plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Authenticated attackers with low privileges can inject persistent JavaScript payloads that execute in the browsers of site visitors and administrators. The vulnerability affects all versions of the all-embed-addons-for-elementor plugin up to and including 1.1.3.

Critical Impact
Stored XSS payloads execute in the context of any user rendering the affected Elementor content, enabling session theft, administrative account takeover, and malicious redirection.

Affected Products

bPlugins All Embed – Elementor Addons plugin for WordPress
Plugin slug: all-embed-addons-for-elementor
Versions from n/a through 1.1.3 (inclusive)

Discovery Timeline

2025-01-24 - CVE CVE-2025-24595 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24595

Vulnerability Analysis

The vulnerability is a stored XSS issue in the All Embed – Elementor Addons plugin. Plugin input fields accept content that is later rendered in generated pages without sufficient sanitization or output encoding. An authenticated user with contributor-level access or higher can inject script payloads into Elementor widgets exposed by the plugin. Those payloads are persisted in the WordPress database and executed when the affected page or widget is rendered in another user's browser.

Because the injected script runs within the origin of the WordPress site, attackers can pivot to administrator sessions, exfiltrate authentication cookies, or issue authenticated requests to WordPress REST endpoints. The scope change reflected in the CVSS vector indicates that impact extends beyond the vulnerable component to any user rendering the compromised content.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Plugin widget handlers store user-controlled attribute values and later emit them into HTML output without applying WordPress escaping primitives such as esc_attr(), esc_html(), or wp_kses_post(). This allows script tags or event-handler attributes supplied by an authenticated user to survive into the rendered DOM.

Attack Vector

Exploitation requires network access to the WordPress admin interface and authenticated privileges sufficient to edit Elementor content. The attack also requires user interaction, meaning a victim must load a page containing the malicious widget. Once triggered, the payload executes with the privileges of the viewing user. See the Patchstack XSS Vulnerability Report for additional technical detail.

No verified public proof-of-concept code is available. The vulnerability class typically involves injecting HTML event handlers or <script> fragments into plugin widget attributes exposed through the Elementor editor.

Detection Methods for CVE-2025-24595

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or javascript: URIs stored in WordPress wp_postmeta or wp_posts rows associated with Elementor data.
Outbound requests from visitor browsers to unfamiliar domains after loading pages that use All Embed widgets.
New or modified administrator accounts created shortly after Elementor page edits by lower-privileged users.

Detection Strategies

Query the WordPress database for Elementor meta values containing script fragments or HTML event-handler attributes.
Review plugin and post revision logs for edits performed by contributor or author accounts on pages using All Embed widgets.
Inspect web server access logs for POST requests to /wp-admin/admin-ajax.php and Elementor save endpoints originating from low-privilege sessions.

Monitoring Recommendations

Deploy a web application firewall (WAF) rule set that flags script and event-handler payloads in Elementor save requests.
Alert on Content Security Policy (CSP) violation reports from site visitors indicating inline script execution.
Monitor administrator authentication events for anomalies following content edits by non-admin users.

How to Mitigate CVE-2025-24595

Immediate Actions Required

Upgrade the All Embed – Elementor Addons plugin to a version later than 1.1.3 as soon as the vendor releases a fixed build.
Audit contributor, author, and editor accounts and remove any that are unused or unnecessary.
Review recent Elementor content edits and remove any pages containing injected script content.

Patch Information

Refer to the Patchstack advisory for the current patch status. At the time of publication, versions up to and including 1.1.3 are affected. Apply the vendor-supplied update once available through the WordPress plugin repository.

Workarounds

Deactivate and remove the All Embed – Elementor Addons plugin until a patched version is installed.
Restrict Elementor editing privileges to trusted administrator accounts only.
Enforce a strict Content Security Policy that disallows inline script execution on public pages.
Deploy a WordPress-aware WAF to block XSS payloads submitted to Elementor save endpoints.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate all-embed-addons-for-elementor
wp plugin delete all-embed-addons-for-elementor