CVE-2025-32190: Musician's Pack For Elementor XSS Flaw

CVE-2025-32190 Overview

CVE-2025-32190 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Musician's Pack For Elementor WordPress plugin developed by smartwpress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Affected installations include all plugin versions up to and including 1.8.7. An authenticated attacker with low privileges can inject client-side script that executes in a victim's browser after user interaction. Successful exploitation impacts confidentiality, integrity, and availability at limited scope, and the scope of the attack changes because the injected script executes in the user's browser context.

Critical Impact
Authenticated contributors can inject malicious JavaScript that runs in the browsers of site visitors or administrators, enabling session theft, credential harvesting, and unauthorized actions on behalf of victims.

Affected Products

smartwpress Musician's Pack For Elementor plugin for WordPress
All versions from initial release through 1.8.7
WordPress sites using Elementor with this plugin installed

Discovery Timeline

2025-04-04 - CVE-2025-32190 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32190

Vulnerability Analysis

The vulnerability is a DOM-based Cross-Site Scripting flaw in the Musician's Pack For Elementor plugin. DOM-based XSS occurs entirely in the browser when client-side JavaScript reads attacker-controlled data from a source such as the URL, document.location, or a form field, and writes it into a dangerous sink such as innerHTML without sanitization.

In this case, the plugin processes user-supplied input on the page without proper output encoding or sanitization. When the affected component renders content, injected markup is parsed and executed by the browser rather than treated as literal text. The attacker requires low privileges and user interaction to trigger the payload. Refer to the Patchstack XSS Vulnerability Advisory for additional technical context.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin fails to sanitize or encode input before passing it to a DOM sink. Client-side JavaScript within the plugin writes attacker-controlled values into the DOM without applying safe APIs such as textContent or without HTML-entity encoding.

Attack Vector

An attacker with low-privileged access to a WordPress site running the vulnerable plugin crafts a malicious payload and stores or delivers it through the plugin's affected component. A privileged user or site visitor then interacts with the affected page, causing the injected script to execute in their browser session. Because the scope changes, the executed script can access resources beyond the vulnerable component, including cookies and DOM data belonging to the WordPress site.

No verified public exploit code is available. The Patchstack advisory linked in the references provides the disclosed technical details.

Detection Methods for CVE-2025-32190

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event-handler attributes (onerror, onload) stored in plugin-related post meta, options, or widget content
WordPress administrator or contributor sessions performing unusual actions such as creating users, changing roles, or modifying plugin settings without corresponding audit trail
Outbound browser requests from admin sessions to attacker-controlled domains referenced in plugin content

Detection Strategies

Inventory WordPress installations and identify sites running Musician's Pack For Elementor at version 1.8.7 or earlier
Review plugin-generated content in the database for HTML tags and JavaScript event handlers using SQL queries against wp_postmeta and wp_options
Enable Content Security Policy (CSP) reporting to capture script-source violations that indicate injection attempts

Monitoring Recommendations

Log and alert on WordPress administrative actions performed shortly after an admin views pages containing plugin widgets
Monitor web server access logs for requests containing encoded script payloads targeting plugin endpoints
Track plugin version drift across WordPress fleets and flag installations that remain on vulnerable releases

How to Mitigate CVE-2025-32190

Immediate Actions Required

Update the Musician's Pack For Elementor plugin to a version later than 1.8.7 once the vendor publishes a patched release
Restrict contributor and author role assignments to trusted users while a patched version is unavailable
Audit existing plugin content for previously stored malicious payloads and remove them

Patch Information

The vulnerability affects Musician's Pack For Elementor through version 1.8.7. Consult the Patchstack XSS Vulnerability Advisory and the smartwpress plugin page on the WordPress plugin repository for the latest fixed release information.

Workarounds

Deactivate and remove the Musician's Pack For Elementor plugin until a patched version is installed
Deploy a Web Application Firewall (WAF) with rules that block common XSS payloads targeting WordPress plugin parameters
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Example WordPress CLI commands to inventory and disable the vulnerable plugin
wp plugin list --name=music-pack-for-elementor --fields=name,status,version
wp plugin deactivate music-pack-for-elementor