CVE-2025-5338: Royal Elementor Addons XSS Vulnerability

CVE-2025-5338 Overview

CVE-2025-5338 is a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Elementor Addons plugin for WordPress. The flaw affects all versions up to and including 1.7.1028 and stems from insufficient input sanitization and output escaping on user-supplied attributes across multiple widgets. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. The issue is tracked under [CWE-79] and was published to the National Vulnerability Database on June 26, 2025.

Critical Impact
Contributor-level users can persist malicious JavaScript in widget attributes, executing scripts against visitors and administrators of affected WordPress sites.

Affected Products

Royal Elementor Addons plugin for WordPress, versions up to and including 1.7.1028
WordPress sites using vulnerable widget configurations from the plugin
Multi-author WordPress deployments where contributor accounts exist

Discovery Timeline

2025-06-26 - CVE-2025-5338 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5338

Vulnerability Analysis

The vulnerability resides in multiple widgets shipped with the Royal Elementor Addons plugin. The plugin accepts user-supplied attribute values passed into widget rendering logic without applying WordPress sanitization functions such as sanitize_text_field() or output escaping functions such as esc_attr() and esc_html(). When a contributor edits a page and supplies widget attributes containing JavaScript payloads, the plugin stores the raw input in the post metadata. On subsequent page renders, the plugin emits the attacker-controlled content directly into the DOM. Any visitor loading the page executes the injected script under the origin of the WordPress site. The fix was delivered in WordPress Changeset #3338468.

Root Cause

The plugin fails to enforce input validation and output encoding in widget attribute handlers. Widget parameters flow from the editor into the frontend renderer without passing through WordPress's escaping API. This design gap allows HTML and script content to survive persistence and reach the browser intact.

Attack Vector

Exploitation requires authenticated access at contributor level or higher and user interaction to view the compromised page. An attacker with a contributor account creates or edits a post containing a vulnerable Royal Elementor Addons widget. The attacker embeds a JavaScript payload in an unsanitized attribute. When an editor, administrator, or site visitor loads the page, the payload executes in their browser session. Scope change indicates the impact extends beyond the vulnerable component to any user of the WordPress site. Technical implementation details are documented in the WordPress Plugin Frontend JavaScript source.

No public proof-of-concept code has been released. The vulnerability mechanism follows the standard stored XSS pattern documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-5338

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or on* event handler attributes stored in wp_postmeta rows tied to Royal Elementor Addons widgets
Outbound requests from administrator browsers to unknown domains shortly after loading pages containing plugin widgets
New or modified WordPress user accounts created without an audit trail following contributor logins
Injected iframes or redirects observed in rendered plugin widget markup

Detection Strategies

Query wp_postmeta for widget attribute values containing <script, onerror=, onload=, or javascript: substrings
Enable WordPress audit logging to capture post edits performed by contributor-level accounts
Deploy a Web Application Firewall rule set that flags stored XSS payloads in requests to /wp-admin/admin-ajax.php and /wp-json/wp/v2/
Compare installed plugin version against the patched release using WP-CLI: wp plugin get royal-elementor-addons

Monitoring Recommendations

Monitor Content Security Policy violation reports for unexpected inline script execution on public pages
Alert on any contributor account performing high-frequency post edits to pages containing plugin widgets
Track file integrity of plugin directory wp-content/plugins/royal-elementor-addons/ for unauthorized modifications

How to Mitigate CVE-2025-5338

Immediate Actions Required

Update the Royal Elementor Addons plugin to a version later than 1.7.1028 that includes the fix from WordPress Changeset #3338468
Audit all pages authored or edited by contributor-level accounts for injected script content
Review the WordPress user list and remove or downgrade untrusted contributor accounts
Rotate administrator session cookies and passwords if suspicious activity is detected

Patch Information

The vendor addressed the vulnerability by adding sanitization and output escaping on the affected widget attributes. Site owners should update through the WordPress plugin dashboard or via WP-CLI. Refer to the Royal Elementor Addons Developer Info page for release notes and the changeset link above for the exact code changes.

Workarounds

Restrict contributor-level accounts and require editor review before publishing any post containing plugin widgets
Deploy a Content Security Policy that blocks inline scripts to reduce the impact of stored XSS payloads
Temporarily deactivate the Royal Elementor Addons plugin on sites that cannot patch immediately
Apply a Web Application Firewall virtual patch that filters script payloads submitted through the plugin's widget endpoints

bash

# Configuration example: update the plugin using WP-CLI
wp plugin update royal-elementor-addons
wp plugin get royal-elementor-addons --field=version

# Optional: audit postmeta for suspicious payloads
wp db query "SELECT post_id, meta_key FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%';"