CVE-2025-4944 Overview
CVE-2025-4944 is a Stored Cross-Site Scripting (XSS) vulnerability in the LA-Studio Element Kit for Elementor plugin for WordPress. The flaw affects all plugin versions up to and including 1.5.2 and resides in the Image Compare and Google Maps widgets. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript. The injected scripts execute in the browser of any user visiting an affected page. This weakness is tracked as [CWE-79].
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the context of any visitor, including administrators, enabling session theft and account takeover.
Affected Products
- LA-Studio Element Kit for Elementor plugin for WordPress — all versions through 1.5.2
- Image Compare widget component
- Google Maps widget component
Discovery Timeline
- 2025-05-30 - CVE-2025-4944 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4944
Vulnerability Analysis
The vulnerability is a Stored XSS flaw introduced through unsanitized widget attributes. The Image Compare and Google Maps widgets accept user-controlled input that is written back into rendered pages without proper escaping. Because the payload persists in the database, it re-executes each time the affected page is rendered.
Exploitation requires authentication at the contributor level or above. WordPress deployments that allow open registration or delegate content creation to low-privilege authors expand the attack surface. The vulnerability crosses a trust boundary because injected scripts run in the browsers of higher-privileged users, including editors and administrators. Successful execution can lead to session hijacking, forced administrative actions via CSRF, and malicious redirects to phishing or malware infrastructure.
Root Cause
The plugin fails to sanitize attribute values submitted through the Image Compare and Google Maps widgets and does not escape the values when generating HTML output. Both defenses are required to prevent script injection in Elementor-based widgets. See the WordPress Plugin Changeset for the specific code changes that address the issue.
Attack Vector
An attacker with contributor-level credentials edits a page containing an Image Compare or Google Maps widget and supplies a crafted attribute value containing JavaScript. When any visitor loads the page, the browser parses the injected markup and executes the payload. Refer to the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-4944
Indicators of Compromise
- Unexpected <script> tags, event handlers such as onerror or onload, or javascript: URIs stored in Elementor widget metadata within the wp_postmeta table.
- Outbound requests from administrator browsers to unknown domains shortly after loading pages that use LA-Studio widgets.
- New administrator accounts or modified user roles created outside normal change windows.
Detection Strategies
- Query wp_postmeta for Elementor data referencing image-compare or google-maps widget types and inspect stored attributes for HTML or JavaScript syntax.
- Deploy web application firewall rules that flag POST requests to admin-ajax.php and post.php containing script fragments in widget attributes.
- Correlate contributor-level content edits with subsequent anomalous browser behavior in editor and administrator sessions.
Monitoring Recommendations
- Alert on Content Security Policy (CSP) violation reports originating from pages built with the LA-Studio plugin.
- Monitor WordPress audit logs for role changes, plugin installations, and edits performed by contributor-level accounts.
- Track anomalous authenticated sessions and unusual API calls that follow visits to editor screens.
How to Mitigate CVE-2025-4944
Immediate Actions Required
- Update the LA-Studio Element Kit for Elementor plugin to a version later than 1.5.2 as soon as a fixed release is available.
- Audit all contributor, author, and editor accounts and remove or downgrade unused or untrusted users.
- Review existing pages that use the Image Compare and Google Maps widgets for injected scripts and remove malicious content.
Patch Information
The upstream code fix is available in the WordPress Plugin Changeset. Administrators should apply the vendor update through the WordPress plugin manager. Review the Lastudio Element Kit Documentation for supported release channels.
Workarounds
- Temporarily deactivate the LA-Studio Element Kit plugin until the patched version can be deployed.
- Restrict contributor and author registration and require administrator approval for new accounts.
- Enforce a strict Content Security Policy that blocks inline scripts and disallows untrusted external script sources.
- Deploy a WAF ruleset that inspects and blocks script payloads submitted through Elementor widget parameters.
# Example CSP header restricting inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
