CVE-2025-4479: ElementsKit Elementor Addons XSS Vulnerability

CVE-2025-4479 Overview

CVE-2025-4479 is a stored cross-site scripting (XSS) vulnerability in the ElementsKit Elementor Addons and Templates plugin for WordPress. The flaw affects all versions up to and including 3.5.2 of the elementskit-lite plugin from wpmet. The image comparison widget fails to sanitize input and escape output on the before/after label attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any user who visits the injected page. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can plant persistent JavaScript payloads that execute in the browser context of site visitors and administrators, enabling session theft, privilege escalation, and site defacement.

Affected Products

wpmet ElementsKit Elementor Addons and Templates (elementskit-lite) versions up to and including 3.5.2
WordPress sites using the image comparison widget provided by ElementsKit
Sites permitting contributor-level or higher user registration with access to Elementor widgets

Discovery Timeline

2025-06-19 - CVE-2025-4479 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-4479

Vulnerability Analysis

The vulnerability resides in the image comparison widget shipped with the ElementsKit plugin. The widget accepts user-supplied strings for the before/after label attributes. The plugin renders these attributes into the page output without applying WordPress escaping functions such as esc_attr() or esc_html(). Any script content stored in these attributes persists in the database and executes whenever the affected page loads. Because the payload is stored, every visitor triggers the injected code, and the attack does not require the initial attacker to remain active.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render for the image comparison widget's label parameters. The plugin trusts contributor-supplied widget attributes and passes them directly into HTML output. WordPress capability boundaries assume contributors cannot inject scripts, so the sanitization gap breaks that trust boundary.

Attack Vector

An attacker authenticates to a target WordPress site with contributor privileges or higher. The attacker creates or edits a post containing the ElementsKit image comparison widget. The attacker inserts a JavaScript payload into the before-label or after-label field. When an administrator previews the post or a visitor loads the published page, the browser executes the payload in the site's origin. This enables cookie theft, forced actions via the admin session, and drive-by content changes. User interaction is required to trigger execution, and the scope changes because injected script runs in the trusted site context.

No public proof-of-concept exploit is listed in the NVD references. Technical detail is available in the Wordfence Vulnerability Report and the Elementskit Changeset Overview.

Detection Methods for CVE-2025-4479

Indicators of Compromise

Post or page content in wp_posts containing <script>, onerror=, onload=, or javascript: strings within ElementsKit image comparison widget shortcodes or Elementor JSON data
New or modified posts authored by contributor-level accounts that include the eael-image-comparison or elementskit-image-comparison widget markup
Outbound requests from visitor browsers to unfamiliar domains after loading pages built with ElementsKit widgets
Unexpected administrator account creation or plugin installation events following contributor edits

Detection Strategies

Audit Elementor page data stored in wp_postmeta under the _elementor_data key for script tags or event handler attributes inside image comparison widget settings
Enforce a Content Security Policy that reports inline script violations, then triage reports mapping to ElementsKit-rendered pages
Correlate WordPress activity logs to flag contributor accounts editing posts that render script content on the front end

Monitoring Recommendations

Log and review all post edits performed by non-administrator roles, including revisions to Elementor widget data
Monitor the installed plugin version through the WordPress REST API /wp/v2/plugins endpoint or file hashes of elementskit-lite
Alert on browser telemetry from admin sessions that shows script execution originating from published post URLs rather than the WordPress admin domain

How to Mitigate CVE-2025-4479

Immediate Actions Required

Update the ElementsKit Elementor Addons and Templates plugin to a version later than 3.5.2 that includes the fix documented in changeset 3311822
Review all posts created or modified by contributor and author accounts since installing an affected version and remove suspicious widget content
Rotate credentials for administrator accounts that may have loaded a compromised page while authenticated
Restrict contributor-level registration where the workflow does not require it

Patch Information

The vendor addressed the issue in the changeset published at Elementskit Changeset 3311822. The fix adds proper sanitization and escaping to the image comparison widget's before/after label attributes. Administrators should apply the update through the WordPress plugin manager and verify the installed version is above 3.5.2. Details of the pre-patch vulnerable code paths are visible in the Elementor.js file and widget-scripts.js file.

Workarounds

Temporarily disable the ElementsKit image comparison widget through the plugin's widget management panel until patching is complete
Downgrade users who do not require content creation from contributor to subscriber role
Deploy a web application firewall rule that blocks HTML tags and JavaScript event attributes in POST bodies targeting /wp-admin/admin-ajax.php with the elementor_ajax action
Apply a strict Content Security Policy that disallows inline scripts on public pages served by WordPress