CVE-2025-39543: Royal Elementor Addons Stored XSS Vulnerability

CVE-2025-39543 Overview

CVE-2025-39543 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Royal Royal Elementor Addons plugin for WordPress. The flaw exists in all versions up to and including 1.3.977. Attackers with low-privileged authenticated access can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The vulnerability is tracked under CWE-79 for improper neutralization of input during web page generation.

Critical Impact
Authenticated attackers can store malicious scripts that execute against site visitors and administrators, enabling session theft, forced actions, and potential site takeover through admin-context script execution.

Affected Products

WP Royal — Royal Elementor Addons (royal-elementor-addons)
All versions from n/a through <= 1.3.977
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2025-04-16 - CVE-2025-39543 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39543

Vulnerability Analysis

The vulnerability results from improper neutralization of user-supplied input rendered into web pages generated by the Royal Elementor Addons plugin. Input passed through affected widget or configuration fields is stored in the database and later reflected in page output without adequate sanitization or output encoding.

Because the payload is persisted, exploitation does not require the attacker to interact with each victim. Any user who loads a page containing the injected content executes the script under the site's origin. This exposes cookies, DOM contents, and authenticated actions to the attacker.

Exploitation requires low privileges (PR:L) and user interaction to trigger the stored payload. The scope is changed (S:C), meaning the injected script can affect resources beyond the vulnerable component, such as administrator sessions.

Root Cause

The root cause is missing or insufficient sanitization of input processed by the plugin before it is written to the database and rendered back to page output. Standard WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() are not applied consistently to affected fields, allowing HTML and JavaScript to be stored verbatim.

Attack Vector

An authenticated contributor or editor injects a crafted payload into a plugin-controlled field such as a widget content area, custom label, or URL attribute. The payload is stored and later executed in the browser of any user rendering the affected page. Full technical details are available in the Patchstack Vulnerability Report.

// No verified proof-of-concept code is published.
// The vulnerability involves unsanitized user input
// stored via a plugin widget field and rendered
// back into the DOM without output encoding.

Detection Methods for CVE-2025-39543

Indicators of Compromise

Unexpected <script>, <iframe>, or on* event-handler attributes stored in wp_postmeta or wp_options rows related to Royal Elementor Addons
Outbound requests from visitor browsers to unknown domains after loading pages containing plugin widgets
New or modified administrator accounts created shortly after content edits by lower-privileged users

Detection Strategies

Review plugin-managed content and widget configurations for HTML tags or JavaScript payloads that should not appear in normal editorial input
Enable WordPress audit logging to correlate content changes made by contributor and editor accounts with subsequent script execution reports
Deploy a Content Security Policy (CSP) in report-only mode to surface script sources that are not part of the site's expected origins

Monitoring Recommendations

Monitor web server logs for anomalous request patterns targeting plugin AJAX endpoints under /wp-admin/admin-ajax.php
Alert on cookie exfiltration attempts and unexpected document.cookie access via browser telemetry or a web application firewall
Track plugin version inventory across WordPress fleets to identify any installations still running versions at or below 1.3.977

How to Mitigate CVE-2025-39543

Immediate Actions Required

Update Royal Elementor Addons to a version above 1.3.977 on every affected WordPress site
Audit user accounts with contributor privileges or higher and revoke unnecessary access
Review recent posts, pages, and widget configurations for injected script content and remove any unauthorized payloads

Patch Information

WP Royal has published a fixed release above version 1.3.977. Refer to the Patchstack Vulnerability Report for the specific patched version and vendor advisory details. Apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Deactivate the Royal Elementor Addons plugin until the site can be updated to a patched version
Restrict content editing capabilities to trusted administrators as an interim control
Deploy a web application firewall rule blocking script tags and event-handler attributes in request bodies destined for plugin endpoints

bash

# Update the plugin using WP-CLI
wp plugin update royal-elementor-addons

# Verify installed version is above 1.3.977
wp plugin get royal-elementor-addons --field=version

# Temporary mitigation: deactivate the plugin
wp plugin deactivate royal-elementor-addons