CVE-2025-58793: WPB Elementor Addons Stored XSS Vulnerability

CVE-2025-58793 Overview

CVE-2025-58793 is a stored cross-site scripting (XSS) vulnerability in the WPBean WPB Elementor Addons plugin for WordPress. The flaw affects all plugin versions up to and including 1.7. It stems from improper neutralization of user input during web page generation, classified as [CWE-79]. An authenticated attacker with low privileges can inject malicious JavaScript that executes in the browsers of users who view affected pages. The vulnerability was published to the National Vulnerability Database (NVD) on September 5, 2025.

Critical Impact
Attackers can inject persistent JavaScript payloads that execute against site visitors and administrators, enabling session theft, redirection, and content manipulation across the WordPress site.

Affected Products

WPBean WPB Elementor Addons plugin for WordPress
All versions from unspecified initial release through 1.7
WordPress sites running Elementor with this addon installed

Discovery Timeline

2025-09-05 - CVE-2025-58793 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58793

Vulnerability Analysis

The vulnerability resides in WPB Elementor Addons, a WordPress plugin that extends the Elementor page builder. The plugin fails to sanitize or escape user-supplied input before rendering it in generated HTML output. This allows an attacker with contributor-level or higher privileges to embed persistent JavaScript payloads within widget content or configuration fields.

Once stored, the malicious script executes each time a user renders the affected page or component. Because the scope is marked as changed in the CVSS vector, the injected script can affect resources beyond the vulnerable component, including administrator sessions. Exploitation requires user interaction, typically a victim visiting the compromised page.

Root Cause

The root cause is missing output encoding and input validation on plugin fields that accept user-controllable strings. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses_post() for output sanitization, but the plugin renders values directly into the DOM without applying them consistently. This gap enables persistent XSS storage in the WordPress database.

Attack Vector

An authenticated attacker submits crafted payloads through plugin-controlled input fields. The payload persists in the database and executes in the browser of any user who loads the affected page. In multi-author WordPress environments, a contributor account is sufficient to weaponize the flaw against editors and administrators. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-58793

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror or onload, or javascript: URIs stored in WordPress post meta or plugin option tables
Outbound requests from browser sessions to unfamiliar domains after loading pages built with WPB Elementor Addons
Administrator sessions exhibiting unauthorized actions such as new user creation or plugin installation

Detection Strategies

Audit database rows in wp_postmeta and plugin configuration tables for HTML or JavaScript syntax in fields expected to contain plain text
Review web server access logs for repeated POST requests to admin-ajax.php or Elementor editor endpoints from low-privilege accounts
Deploy Content Security Policy (CSP) reporting to surface script executions from unauthorized origins

Monitoring Recommendations

Alert on privilege escalation events, particularly new administrator accounts created shortly after contributor logins
Monitor plugin file integrity and WordPress option changes for the wpb-elementor-addons namespace
Enable audit logging plugins to capture edits to pages containing the affected widgets

How to Mitigate CVE-2025-58793

Immediate Actions Required

Update WPB Elementor Addons to a version later than 1.7 once the vendor publishes a patched release
Restrict contributor and author role assignments to trusted users only
Review recent edits to pages using WPB Elementor Addons widgets and remove suspicious markup

Patch Information

No patched version is documented in the NVD entry at the time of publication. Site operators should monitor the Patchstack advisory and the WordPress plugin repository for a fixed release.

Workarounds

Deactivate and remove the WPB Elementor Addons plugin until a patched version is available
Deploy a web application firewall (WAF) rule to block script tags and event handler attributes submitted through Elementor endpoints
Apply a strict Content Security Policy that disallows inline scripts and untrusted script sources

bash

# Content Security Policy header example for WordPress (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;