CVE-2025-4566: Elementor Website Builder XSS Vulnerability

CVE-2025-4566 Overview

CVE-2025-4566 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Website Builder – More Than Just a Page Builder plugin for WordPress. The flaw affects all versions up to and including 3.30.2. The vulnerability resides in the data-text DOM element attribute handled by the Text Path widget. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary web scripts. Injected scripts execute when users view an affected page. The attack surface is limited to Chromium-based browsers, specifically Google Chrome and Microsoft Edge.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in visitors' browsers, enabling session theft, account takeover, and unauthorized administrative actions in Chrome and Edge.

Affected Products

Elementor Website Builder – More Than Just a Page Builder plugin for WordPress
All versions up to and including 3.30.2
Text Path widget component (text-path.acb8842ac7e1cd1dfb44.bundle.js)

Discovery Timeline

2025-07-29 - CVE-2025-4566 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4566

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under CWE-79. The Text Path widget in Elementor writes user-controlled content into the data-text attribute of a DOM element without adequate sanitization or output escaping. Chromium-based browsers process this attribute in a way that permits attacker-supplied markup to execute as JavaScript within the page context.

Authenticated attackers with Contributor privileges or higher can persist malicious payloads inside pages built with the Text Path widget. The payload executes whenever a visitor loads the affected page in Chrome or Edge. Firefox and Safari users are not affected under the conditions described in the advisory.

The stored nature of the flaw broadens impact: a single injection reaches every subsequent visitor, including administrators. Script execution in an administrator's session can lead to privilege escalation, plugin installation, or persistent backdoors in the WordPress environment.

Root Cause

The plugin's Text Path widget assigns user-supplied strings to the data-text DOM attribute without applying context-aware escaping. Chromium's parsing of the attribute permits execution paths that Firefox and Safari do not follow. References to the vulnerable code paths appear at lines 147 and 190 of the text-path.acb8842ac7e1cd1dfb44.bundle.js bundle. The absence of both server-side sanitization and client-side escaping enables the payload to persist and later render as executable script.

Attack Vector

An attacker authenticates to the target WordPress site with at least Contributor privileges. The attacker edits or creates a page using the Text Path widget and inserts a crafted payload into the field that populates the data-text attribute. Once the page is saved and later loaded by any user in Chrome or Edge, the injected script executes with the privileges of that user's browser session.

The Text Path widget writes the attacker-supplied data-text value into the DOM. Browser parsing behavior in Chromium then interprets embedded script constructs, resulting in JavaScript execution in the page origin. See the WordPress Elementor Bundle JS - Line 147 and Line 190 references for the affected code paths.

Detection Methods for CVE-2025-4566

Indicators of Compromise

Elementor Text Path widget instances containing <script>, javascript:, or event handler markup inside the data-text attribute value
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages using the Text Path widget
New or modified WordPress administrator accounts created shortly after a Contributor edited a page with a Text Path widget
Unusual DOM mutations in Elementor-rendered pages observed only in Chromium-based browsers

Detection Strategies

Audit the WordPress database (wp_postmeta and wp_posts) for Elementor page data referencing text-path widgets and inspect data-text values for HTML or script content.
Scan rendered page HTML for data-text attributes containing suspicious characters such as <, >, " or JavaScript keywords.
Correlate contributor and author activity logs with modifications to pages that render Text Path widgets.

Monitoring Recommendations

Enable a Content Security Policy (CSP) that blocks inline scripts and report violations to a monitored endpoint.
Log all edits performed by users with Contributor role or above and alert on Elementor widget modifications.
Monitor WordPress plugin update status and flag installations running Elementor 3.30.2 or earlier.

How to Mitigate CVE-2025-4566

Immediate Actions Required

Update the Elementor Website Builder plugin to a version later than 3.30.2 that contains the patch referenced in the WordPress Elementor Changeset.
Audit existing pages that use the Text Path widget and remove any data-text values containing HTML or script content.
Review Contributor, Author, and Editor accounts for unauthorized or dormant users and revoke unnecessary privileges.

Patch Information

The vendor addressed the flaw in a subsequent Elementor release following version 3.30.2. Refer to the Wordfence Vulnerability Report for patch confirmation and the associated changeset. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Restrict page-editing capabilities so that only trusted users hold Contributor role or higher until the patch is applied.
Disable or remove the Text Path widget from Elementor page templates if patching is delayed.
Deploy a Web Application Firewall (WAF) rule that inspects Elementor POST payloads for HTML tags or JavaScript keywords in Text Path fields.
Enforce a strict Content Security Policy that prohibits inline JavaScript execution on public pages.

bash

# Update Elementor via WP-CLI to the latest patched version
wp plugin update elementor

# Verify installed version is newer than 3.30.2
wp plugin get elementor --field=version