CVE-2025-24729: Elementor Addons Stored XSS Vulnerability

CVE-2025-24729 Overview

CVE-2025-24729 is a stored Cross-Site Scripting (XSS) vulnerability in the ElementInvader Addons for Elementor WordPress plugin. The flaw affects all versions up to and including 1.3.3. The plugin fails to properly neutralize user-supplied input during web page generation, allowing authenticated users with low privileges to inject persistent JavaScript payloads. When other users or administrators view the affected page, the payload executes in their browser context. The vulnerability is tracked under CWE-79 and documented in the Patchstack XSS Vulnerability Advisory.

Critical Impact
Authenticated attackers can store malicious scripts that execute in administrator browsers, enabling session hijacking, account takeover, and unauthorized content modification.

Affected Products

ElementInvader Addons for Elementor plugin for WordPress
All versions from initial release through 1.3.3
WordPress sites using the plugin with contributor-level or higher accounts

Discovery Timeline

2025-01-24 - CVE-2025-24729 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24729

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the ElementInvader Addons for Elementor plugin. The plugin accepts input through its widget or configuration interfaces and renders that input into generated page markup without sufficient output encoding. Authenticated users with permission to edit Elementor content can inject HTML and JavaScript that persists in the WordPress database.

Exploitation requires low privileges and user interaction. The scope changes because the injected script executes under the origin of the WordPress site, affecting any visitor who loads the compromised page. Impact on confidentiality and integrity is limited to actions available in the victim's browser session, with no direct impact on service availability.

The Exploit Prediction Scoring System (EPSS) rates this at 0.315% probability of exploitation within 30 days as of 2026-10-13. No public proof-of-concept, exploit code, or active in-the-wild exploitation has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin does not apply WordPress sanitization functions such as wp_kses_post(), esc_html(), or esc_attr() to user-controlled fields before echoing them into rendered pages. This allows raw <script> tags and HTML event handlers to persist through the storage and rendering pipeline.

Attack Vector

An attacker with contributor or editor privileges crafts a malicious payload inside an affected ElementInvader widget field. The payload is saved to the WordPress database as part of the page or post content. When an administrator or site visitor loads the page, the browser parses and executes the injected script. Typical outcomes include theft of session cookies, forced administrative actions through CSRF, redirection to attacker-controlled infrastructure, or defacement of rendered content.

No verified exploitation code is published. Refer to the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-24729

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or on* event handlers stored in wp_posts or wp_postmeta entries created by ElementInvader widgets
Outbound requests from administrator browsers to unfamiliar domains shortly after loading pages built with the plugin
New administrator accounts, modified user roles, or altered site options with no corresponding audit trail

Detection Strategies

Query the WordPress database for Elementor data containing script tags or encoded payloads: inspect meta_value entries in wp_postmeta associated with _elementor_data
Review web server access logs for POST requests to admin-ajax.php or Elementor editor endpoints from low-privilege accounts
Deploy a web application firewall (WAF) ruleset tuned for stored XSS patterns in WordPress plugin fields

Monitoring Recommendations

Enable WordPress audit logging to track post edits, user role changes, and plugin configuration updates
Monitor administrator session activity for anomalous API calls originating from browser contexts
Alert on installation or activation of plugin versions at or below 1.3.3

How to Mitigate CVE-2025-24729

Immediate Actions Required

Update ElementInvader Addons for Elementor to a version later than 1.3.3 once the vendor publishes a fix
Audit all pages and posts built with the plugin for stored script payloads and remove malicious content
Review and restrict contributor, author, and editor accounts, and reset credentials for any suspected compromised users

Patch Information

The NVD entry does not list a fixed version. Monitor the Patchstack advisory and the plugin's WordPress.org page for the next release addressing CVE-2025-24729. Apply the patch across all WordPress environments once available.

Workarounds

Deactivate and remove ElementInvader Addons for Elementor until a patched version is published
Restrict Elementor editing permissions to a minimal set of trusted administrators
Deploy a WAF with rules that block script tags and dangerous HTML attributes in plugin input fields
Enforce a strict Content Security Policy (CSP) that disallows inline script execution site-wide

bash

# Example: disable the vulnerable plugin via WP-CLI until a patch ships
wp plugin deactivate elementinvader-addons-for-elementor
wp plugin delete elementinvader-addons-for-elementor

# Audit stored Elementor content for script payloads
wp db query "SELECT post_id, meta_key FROM wp_postmeta \
  WHERE meta_key = '_elementor_data' \
  AND (meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%' OR meta_value LIKE '%javascript:%');"