CVE-2025-4943: Element Kit For Elementor XSS Vulnerability

CVE-2025-4943 Overview

CVE-2025-4943 is a Stored Cross-Site Scripting (XSS) vulnerability in the LA-Studio Element Kit for Elementor plugin for WordPress. The flaw exists in the data-lakit-element-link parameter and affects all versions up to and including 1.5.2. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads an affected page, enabling session theft, redirection, and abuse of authenticated actions performed by higher-privileged users [CWE-79].

Critical Impact
Contributor-level accounts can persist attacker-controlled JavaScript in published pages, enabling browser-based attacks against site visitors and administrators.

Affected Products

LA-Studio Element Kit for Elementor for WordPress, all versions through 1.5.2
WordPress sites running the lastudio-element-kit plugin with Contributor-or-higher registration enabled
Sites relying on the vulnerable wrapper-links addon that processes the data-lakit-element-link attribute

Discovery Timeline

2025-05-30 - CVE-2025-4943 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4943

Vulnerability Analysis

The LA-Studio Element Kit for Elementor extends Elementor with additional widgets and layout wrappers. One feature converts container elements into clickable links by reading a data-lakit-element-link attribute on the server-rendered HTML and processing it client-side through the wrapper-links addon script. The plugin accepts user-supplied link data from Elementor editors and stores it in post content without sufficient sanitization. When the front-end script consumes the attribute, or when the attribute is rendered directly into the DOM, attacker-controlled markup executes in the visitor's browser context.

Because the payload is stored in the WordPress database and served with every page render, exploitation is persistent. The vulnerability requires a logged-in account, but the WordPress Contributor role is intentionally low-trust and often granted to external authors, making the barrier to abuse low on multi-author sites.

Root Cause

The root cause is missing output escaping for the data-lakit-element-link value. The plugin trusts input passed through the Elementor widget interface and writes it into the rendered HTML without applying WordPress escaping helpers such as esc_attr() or wp_kses(). This allows an attacker to break out of the attribute context or embed executable handlers that the browser or the plugin's client-side script processes as script.

Attack Vector

An authenticated attacker with Contributor or higher privileges edits a post or page containing a supported LA-Studio widget. They supply a crafted value for the wrapper link that includes JavaScript payloads or attribute-breaking characters. After the post is viewed by an administrator, editor, or site visitor, the injected script runs with the origin of the WordPress site. Common secondary impacts include stealing authentication cookies not marked HttpOnly, forcing privileged users to perform administrative actions, and redirecting traffic to attacker-controlled infrastructure.

No public proof-of-concept exploit is currently listed for CVE-2025-4943. See the Wordfence Vulnerability Record and the wrapper-links.min.js source for the vulnerable code path.

Detection Methods for CVE-2025-4943

Indicators of Compromise

Post or page content in the wp_posts table containing data-lakit-element-link attribute values with <script>, javascript:, or event-handler substrings such as onerror= or onclick=.
Unexpected outbound requests from visitor browsers to attacker-controlled domains sourced from pages that render LA-Studio widgets.
New or modified administrator accounts, plugins, or theme files following the visit of a privileged user to a page authored by a Contributor.

Detection Strategies

Query the WordPress database for stored payloads: search post_content for data-lakit-element-link values containing angle brackets, backticks, or scheme prefixes like javascript:.
Enable and review web application firewall (WAF) logs for POST requests to admin-ajax.php, wp-admin/post.php, and the Elementor save endpoint that carry suspicious link parameters.
Compare the installed plugin version against the fixed release referenced in WordPress Changeset #3302784.

Monitoring Recommendations

Audit accounts holding Contributor, Author, or Editor roles and correlate their activity with content changes on pages using LA-Studio widgets.
Monitor browser Content Security Policy (CSP) violation reports for inline script executions on public WordPress pages.
Alert on modifications to wp_options, user role assignments, and privileged session creation shortly after a Contributor publishes or updates content.

How to Mitigate CVE-2025-4943

Immediate Actions Required

Update LA-Studio Element Kit for Elementor to the version that includes the fix in WordPress Changeset #3302784, which supersedes 1.5.2.
Review all posts and pages authored or edited by non-administrator accounts for injected data-lakit-element-link payloads and remove malicious content.
Rotate WordPress administrator passwords and invalidate active sessions if untrusted Contributor accounts existed on the site.

Patch Information

The vendor addressed the vulnerability in the WordPress plugin repository. Refer to WordPress Changeset #3302784 for the corrective commit and to the Lastudio Element Kit developer page for release history. Sites using automatic plugin updates receive the fix without manual intervention; managed WordPress providers should confirm the patched version is deployed.

Workarounds

Restrict Contributor and Author role assignments to trusted users only, and disable open user registration on sites that do not require it.
Deploy a WAF rule that blocks HTML tags and JavaScript scheme prefixes inside the data-lakit-element-link parameter until the patched version is installed.
Temporarily deactivate the LA-Studio Element Kit for Elementor plugin if patching is not immediately possible and the site accepts submissions from untrusted authors.

bash

# Configuration example: identify vulnerable installations via WP-CLI
wp plugin get lastudio-element-kit --field=version
wp plugin update lastudio-element-kit

# Search stored content for suspicious payloads in the affected attribute
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%data-lakit-element-link%' \
  AND (post_content LIKE '%<script%' \
    OR post_content LIKE '%javascript:%' \
    OR post_content LIKE '%onerror=%');"