CVE-2025-3076 Overview
CVE-2025-3076 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Website Builder Pro plugin for WordPress. The flaw affects all versions up to and including 3.29.0. It stems from insufficient input sanitization and output escaping on the button_text parameter. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page. The issue is tracked under CWE-79 and is documented in the Wordfence Vulnerability Report.
Critical Impact
Authenticated Contributor-level attackers can inject persistent JavaScript that runs against every visitor, enabling session theft, forced actions, and content defacement.
Affected Products
- Elementor Website Builder Pro plugin for WordPress, all versions through 3.29.0
- WordPress sites permitting Contributor-level or higher accounts
- Any page rendered with an Elementor Pro button widget containing untrusted button_text input
Discovery Timeline
- 2025-06-10 - CVE-2025-3076 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3076
Vulnerability Analysis
The vulnerability is a Stored XSS flaw in the Elementor Pro button widget. The button_text parameter accepts user-supplied content when a Contributor or higher edits a page. The plugin fails to sanitize this input on save and does not escape it on output. As a result, HTML and JavaScript payloads persist inside the page markup. When any visitor loads the page, the browser executes the payload in the site's origin.
Contributor accounts on WordPress cannot publish content directly, but they can create draft pages containing Elementor widgets. An administrator or editor previewing or reviewing that draft becomes an execution target. Payloads that run in an administrator session can create new admin accounts, exfiltrate nonces, or modify plugin settings through authenticated AJAX endpoints.
Root Cause
The root cause is missing sanitization on write and missing escaping on read for the button_text field. WordPress provides functions such as wp_kses_post() for filtering allowed HTML and esc_html() for rendering, but neither is applied consistently to this parameter. The plugin treats attacker-controlled text as trusted markup during template rendering.
Attack Vector
Exploitation requires authentication at Contributor level and user interaction from a higher-privileged reviewer. The attack proceeds over the network against the WordPress admin interface. An attacker adds a button widget to a draft page, sets button_text to a payload containing an event handler or script tag, and saves the draft. When a reviewer or public visitor loads the page, the payload fires. The scope change reflects that scripts execute in the browser context of a different user, expanding the impact beyond the attacker's own account.
No verified public exploit code is available for this issue. Refer to the Wordfence advisory for additional technical context.
Detection Methods for CVE-2025-3076
Indicators of Compromise
- Elementor page metadata (_elementor_data in wp_postmeta) containing <script> tags, on*= event handlers, or javascript: URIs inside button_text fields.
- Unexpected administrator or editor accounts created shortly after a Contributor edits a page.
- Outbound requests from reviewer browsers to unfamiliar domains immediately after previewing Elementor pages.
Detection Strategies
- Query the wp_postmeta table for Elementor data blobs and flag entries where button_text contains angle brackets, event attributes, or javascript: schemes.
- Deploy a Web Application Firewall rule that inspects requests to admin-ajax.php with the elementor_ajax action for script payloads in widget settings.
- Review WordPress audit logs for Contributor accounts editing pages that include button widgets.
Monitoring Recommendations
- Monitor endpoints of administrators and editors for anomalous browser-originated requests to WordPress REST and AJAX endpoints.
- Alert on creation of new users with administrator or editor roles outside change windows.
- Track installed Elementor Pro versions across managed WordPress sites and flag any instance at or below 3.29.0.
How to Mitigate CVE-2025-3076
Immediate Actions Required
- Upgrade Elementor Pro to a release later than 3.29.0 on every WordPress site.
- Audit existing Elementor pages for injected script content in button widgets and remove malicious markup before republishing.
- Review and reduce the number of Contributor and Author accounts, and rotate credentials for any suspected of compromise.
Patch Information
Elementor addressed the issue in a release following version 3.29.0. Consult the Elementor Pro Changelog for the fixed version and update through the WordPress plugin manager or by uploading the patched package.
Workarounds
- Restrict page-editing capabilities so that only trusted Editor and Administrator accounts can use Elementor.
- Deploy a WordPress security plugin or WAF signature that blocks <script> tags and event-handler attributes in elementor_ajax save requests.
- Enforce a Content Security Policy that disallows inline scripts on the front end to limit the impact of stored payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
