CVE-2025-32163: Xpro Elementor Addons Stored XSS Vulnerability

CVE-2025-32163 Overview

CVE-2025-32163 is a stored Cross-Site Scripting (XSS) vulnerability in the Xpro Elementor Addons WordPress plugin. The flaw affects all versions up to and including 1.4.10. Authenticated attackers with contributor-level privileges or higher can inject persistent JavaScript payloads that execute in the browsers of other users who view the affected page. The issue is tracked as [CWE-79] and stems from improper neutralization of user-supplied input during web page generation. Successful exploitation requires user interaction, and the vulnerability crosses a security boundary because scripts execute in the context of the viewing user's session.

Critical Impact
Attackers can hijack administrator sessions, escalate privileges within WordPress, and pivot to full site compromise through persistent script execution.

Affected Products

Xpro Elementor Addons WordPress plugin versions up to and including 1.4.10
WordPress sites using vulnerable versions of the xpro-elementor-addons plugin
Multi-author or membership-based WordPress deployments where lower-privileged users can author content

Discovery Timeline

2025-04-04 - CVE-2025-32163 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32163

Vulnerability Analysis

The Xpro Elementor Addons plugin extends the Elementor page builder with additional widgets and design elements. The plugin accepts user-supplied input through widget parameters and renders that input into page output without adequate sanitization or output encoding. An authenticated user with permission to edit Elementor content can embed malicious JavaScript into widget attributes. When another user later loads the affected page in the WordPress admin or on the front end, the injected script executes in that user's browser context.

Stored XSS in a WordPress context typically enables session cookie theft, forced administrative actions through the REST API, silent creation of new administrator accounts, and injection of malicious redirects or cryptominers into the site.

Root Cause

The root cause is missing or insufficient input sanitization on widget parameters processed by the plugin. Output rendering does not apply WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses_post() before writing user-controlled data into the DOM. The vulnerability is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires network access to the WordPress site and low-level authenticated privileges. The attacker submits a payload through a plugin widget field that accepts text or HTML. The payload persists in the WordPress database. Any authenticated user or visitor who subsequently views the compromised page triggers script execution. Because the scope changes from the attacker's session to the victim's, an attacker with contributor privileges can effectively execute code as an administrator once an admin views the page.

Refer to the Patchstack XSS Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32163

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes such as onerror and onload stored in WordPress wp_posts or wp_postmeta tables
New administrator accounts created shortly after a contributor or author edits an Elementor page
Outbound HTTP requests from admin browsers to unfamiliar domains immediately after loading a page built with Xpro Elementor Addons
Modified active_plugins or siteurl options in wp_options without a corresponding administrator action

Detection Strategies

Query WordPress post content and meta for suspicious HTML patterns associated with XSS payloads, including base64-encoded scripts and obfuscated event handlers
Enable WordPress audit logging to track content edits performed by contributor and author roles
Deploy a Web Application Firewall (WAF) with XSS signature rules in front of the WordPress admin interface

Monitoring Recommendations

Monitor for creation of privileged WordPress users and unexpected role escalations
Alert on plugin and theme file modifications outside of scheduled maintenance windows
Forward WordPress access logs and PHP error logs to a centralized log platform for correlation and retention

How to Mitigate CVE-2025-32163

Immediate Actions Required

Update the Xpro Elementor Addons plugin to a version later than 1.4.10 once the vendor publishes a fixed release
Audit all pages built with the plugin for embedded scripts and remove any unauthorized content
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
Review the WordPress user list and remove any accounts created without authorization

Patch Information

Refer to the Patchstack advisory for the current patch status and the vendor's fixed version. Apply the update through the WordPress plugin manager once available.

Workarounds

Restrict contributor and author role assignments until the plugin is patched
Deploy a WAF ruleset that blocks XSS payloads targeting Elementor widget endpoints
Temporarily deactivate the Xpro Elementor Addons plugin if it is not business-critical
Enforce a strict Content Security Policy (CSP) that disallows inline script execution on WordPress admin pages

bash

# Example: disable the vulnerable plugin via WP-CLI until a patched version is available
wp plugin deactivate xpro-elementor-addons
wp plugin list --status=active | grep xpro-elementor-addons