CVE-2025-5292: Element Pack Elementor Addons XSS Vulnerability

CVE-2025-5292 Overview

CVE-2025-5292 is a Stored Cross-Site Scripting (XSS) vulnerability in the Element Pack Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 5.11.2. It stems from insufficient input sanitization and output escaping on the marker_content parameter. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page, enabling session theft, redirection, and further account compromise. The issue is tracked under CWE-79.

Critical Impact
A Contributor-level account can plant persistent JavaScript that runs against every visitor, including administrators, enabling privilege escalation and site takeover.

Affected Products

Element Pack Addons for Elementor plugin for WordPress
All versions up to and including 5.11.2
WordPress sites allowing Contributor-level registrations or higher

Discovery Timeline

2025-05-31 - CVE-2025-5292 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5292

Vulnerability Analysis

The vulnerability resides in the handling of the marker_content parameter used by the Element Pack Addons for Elementor plugin. The plugin accepts user-supplied content through this parameter without applying adequate sanitization on input or escaping on output. As a result, attacker-controlled markup and script tags are stored in the WordPress database and rendered directly into the page HTML. When any visitor loads the page, the injected payload executes within the site's origin. Because Contributor accounts are commonly permitted on multi-author WordPress sites, the barrier to exploitation is low. See the Wordfence Vulnerability Report for full technical detail.

Root Cause

The plugin fails to call standard WordPress sanitization functions such as wp_kses_post() on the marker_content input, and it does not apply esc_html() or esc_attr() when rendering the value. This dual gap in input filtering and output encoding allows script content to survive the round trip from form submission to browser rendering.

Attack Vector

An attacker first obtains a Contributor-level or higher WordPress account on a target site. The attacker then edits or creates a page using an Element Pack widget that consumes the marker_content parameter, embedding JavaScript in the field. The payload is stored and served to every subsequent visitor of the page. Impact scales with the privileges of visiting users. Administrator visits enable session hijacking, backend action forgery, and creation of persistent backdoor accounts.

No verified proof-of-concept code is published for this issue. The vulnerability mechanism follows the standard stored XSS pattern documented in the WordPress plugin changeset that resolved the flaw.

Detection Methods for CVE-2025-5292

Indicators of Compromise

Page or post content containing <script>, onerror=, onload=, or javascript: sequences inside Element Pack widget attributes
Unexpected outbound requests from visitor browsers to attacker-controlled domains sourced from WordPress pages
New WordPress administrator accounts created shortly after Contributor account activity
Modifications to wp_posts rows referencing Element Pack shortcodes with encoded script payloads

Detection Strategies

Query the wp_posts table for post content containing marker_content combined with script-like patterns or HTML event handlers
Review Contributor and Author account activity logs for anomalous page edits and publishing behavior
Enable Content Security Policy (CSP) reporting to surface inline script violations originating from stored content
Correlate WordPress audit logs with web server access logs to identify pages triggering script execution

Monitoring Recommendations

Alert on creation or modification of pages by low-privilege accounts that include HTML tags or JavaScript keywords
Monitor administrator sessions for actions initiated immediately after viewing content authored by Contributors
Track plugin version inventory across WordPress deployments to identify hosts still running Element Pack 5.11.2 or earlier
Watch for suspicious cookies or authentication tokens appearing in outbound HTTP requests from browser telemetry

How to Mitigate CVE-2025-5292

Immediate Actions Required

Update the Element Pack Addons for Elementor plugin to a version later than 5.11.2 on all WordPress sites
Audit all existing pages using Element Pack widgets for stored script payloads and remove malicious content
Rotate credentials for administrators who may have visited compromised pages and invalidate active sessions
Review the Contributor and Author user list and remove untrusted accounts

Patch Information

The vendor addressed the vulnerability in the plugin update referenced by the WordPress plugin changeset 3302152. Site owners should install the patched release through the WordPress plugin dashboard or via WP-CLI. Confirm the installed version is later than 5.11.2 after upgrade.

Workarounds

Restrict Contributor and Author account registration until the plugin is patched
Deploy a Web Application Firewall (WAF) rule blocking script tags and JavaScript event handlers in the marker_content parameter
Temporarily disable Element Pack widgets that consume marker_content if patching cannot be performed immediately
Enforce a strict Content Security Policy that disallows inline script execution on public-facing pages

bash

# Upgrade Element Pack Addons for Elementor using WP-CLI
wp plugin update element-pack-lite
wp plugin list --name=element-pack-lite --fields=name,version,status