CVE-2025-31857: Directorist AddonsKit Elementor XSS Vulnerability

CVE-2025-31857 Overview

CVE-2025-31857 is a stored Cross-Site Scripting (XSS) vulnerability in the wpWax Directorist AddonsKit for Elementor WordPress plugin. The flaw affects all versions up through and including 1.1.6. An authenticated attacker with low privileges can inject malicious script content that persists in the application and executes in the browsers of other users who view the affected page. The vulnerability is tracked under CWE-79 for improper neutralization of input during web page generation.

Critical Impact
A low-privileged attacker can store JavaScript that executes in administrator or visitor browsers, enabling session theft, account takeover, or redirection to attacker-controlled infrastructure.

Affected Products

wpWax Directorist AddonsKit for Elementor (addonskit-for-elementor)
All plugin versions from initial release through 1.1.6
WordPress sites running the vulnerable plugin with authenticated contributor-level or higher accounts

Discovery Timeline

2025-04-01 - CVE-2025-31857 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31857

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input rendered into WordPress pages by the AddonsKit for Elementor plugin. Input accepted through plugin widgets or configuration fields is not sanitized on write and not escaped on output. As a result, attacker-controlled markup and JavaScript persist in the WordPress database. The payload executes in the browser of any user rendering the affected page.

Because the scope metric is Changed, code executes in the security context of the WordPress admin session rather than the attacker's session. This allows an authenticated contributor or editor to reach administrator functionality indirectly through XSS. User interaction is required, typically an administrator visiting a page containing the stored payload.

Root Cause

The root cause is missing output encoding and input sanitization for fields exposed by the plugin's Elementor widgets. WordPress provides functions such as wp_kses_post, esc_html, and esc_attr to neutralize HTML control characters, but the affected plugin code paths omit these calls before echoing user-controlled values back into the DOM.

Attack Vector

An attacker with a low-privileged authenticated account submits a widget configuration or content field containing JavaScript. The malicious content is stored server-side and re-served to any user rendering the page. When an administrator opens the page in a browser, the payload runs with the administrator's session cookies. Refer to the Patchstack WordPress Vulnerability Advisory for detailed advisory context.

Detection Methods for CVE-2025-31857

Indicators of Compromise

WordPress post, page, or postmeta records containing <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload= inside AddonsKit widget configuration.
Unexpected outbound requests from administrator browsers to unknown domains shortly after loading pages that use Directorist AddonsKit widgets.
New administrator accounts or altered user roles created without a corresponding audit trail in WordPress logs.

Detection Strategies

Query the WordPress database for HTML event handlers or <script> fragments in wp_postmeta rows associated with the plugin's option keys.
Audit plugin inventory and version data to identify sites running addonskit-for-elementor at version 1.1.6 or earlier.
Deploy a Web Application Firewall (WAF) ruleset that flags requests containing script-like payloads targeting the plugin's admin-ajax or REST endpoints.

Monitoring Recommendations

Log and alert on modifications to plugin options and widget content performed by non-administrator accounts.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages rendered by Elementor.
Track anomalous session activity from administrator accounts, including unusual API calls immediately after page loads.

How to Mitigate CVE-2025-31857

Immediate Actions Required

Update Directorist AddonsKit for Elementor to a version later than 1.1.6 as soon as the vendor publishes a fixed release.
Audit contributor, author, and editor accounts and remove any that are unused or unrecognized.
Review existing plugin widget configurations for embedded scripts and remove any suspicious payloads.

Patch Information

The advisory published by Patchstack lists all versions through 1.1.6 as vulnerable. Site operators should monitor the Patchstack WordPress Vulnerability Advisory and the plugin's WordPress.org page for a patched release and apply it immediately upon availability.

Workarounds

Deactivate and remove the Directorist AddonsKit for Elementor plugin until a patched version is released.
Restrict plugin editing capabilities so only trusted administrators can modify widget content and plugin options.
Implement a strict Content Security Policy that disallows inline scripts on frontend pages served by WordPress.
Deploy a WordPress-aware WAF rule set that filters XSS payloads submitted to plugin endpoints.

bash

# Configuration example: identify vulnerable installations via WP-CLI
wp plugin list --format=csv | grep addonskit-for-elementor

# Deactivate the plugin until a fix ships
wp plugin deactivate addonskit-for-elementor

# Example CSP header to mitigate inline script execution
# Add to your web server configuration (nginx example)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";