CVE-2025-5944: Element Pack Elementor Plugin XSS Vulnerability

CVE-2025-5944 Overview

CVE-2025-5944 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Element Pack Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 8.0.0. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript through the data-caption attribute. The injected script executes in the browser of any visitor who views the affected page. The vulnerability stems from insufficient input sanitization and output escaping in multiple widget modules, including custom gallery, image accordion, and lightbox.

Critical Impact
Authenticated contributors can store persistent JavaScript payloads that execute against site visitors and administrators, enabling session theft, privilege escalation, and site defacement.

Affected Products

BDThemes Element Pack Addons for Elementor (Lite) — all versions through 8.0.0
WordPress sites running the bdthemes-element-pack-lite plugin
Elementor-based pages using the custom gallery, image accordion, or lightbox widgets

Discovery Timeline

2025-07-03 - CVE-2025-5944 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5944

Vulnerability Analysis

The plugin fails to sanitize user-supplied input written to the data-caption HTML attribute before rendering it in the DOM. Attackers with Contributor privileges can craft widget content that breaks out of the attribute context and injects arbitrary scripts. Because the payload is stored in the WordPress database, it executes for every visitor who loads the affected post or page. The attack chain requires one additional user interaction to trigger script execution, and the resulting code runs in the victim's browser session with full access to site cookies and the DOM.

Root Cause

The root cause is improper neutralization of input during web page generation. Several widget rendering paths in the plugin — including modules/custom-gallery/widgets/custom-gallery.php, modules/image-accordion/widgets/image-accordion.php, and modules/lightbox/widgets/lightbox.php — write caption data directly into HTML attributes without escaping with WordPress functions such as esc_attr(). The bundled bdt-uikit.js lightbox component then processes these attributes, allowing attribute-breakout payloads to execute as JavaScript.

Attack Vector

Exploitation requires network access and an authenticated Contributor account on the target WordPress site. The attacker edits an Elementor page using one of the vulnerable widgets and supplies a malicious payload in a field that is written to the data-caption attribute. When an administrator or visitor views the published page and interacts with the affected gallery, accordion, or lightbox element, the stored JavaScript executes in their browser. The script runs within the site origin and can harvest session cookies, perform actions on behalf of the victim, or pivot to administrator takeover.

See the Wordfence Vulnerability Report and the WordPress Changeset #3319668 for technical specifics.

Detection Methods for CVE-2025-5944

Indicators of Compromise

Elementor post content containing data-caption attribute values with <script>, onerror, onload, or javascript: substrings
Unexpected modifications to posts or pages authored by Contributor-level accounts
Outbound requests from administrator browser sessions to attacker-controlled domains shortly after viewing gallery or lightbox pages
Newly created administrator accounts or role changes following Contributor activity

Detection Strategies

Query the wp_posts table for Elementor data containing suspicious data-caption payloads or encoded script fragments
Review WordPress audit logs for Contributor accounts editing posts that use custom gallery, image accordion, or lightbox widgets
Inspect rendered HTML of published pages for attributes that break out of quoting with event handlers

Monitoring Recommendations

Enable WordPress activity logging to capture post edits, role assignments, and plugin configuration changes
Deploy a web application firewall (WAF) with rules that block stored XSS patterns in POST requests to admin-ajax.php and the Elementor editor endpoints
Monitor browser error telemetry and content security policy (CSP) violation reports for unexpected script execution on content pages

How to Mitigate CVE-2025-5944

Immediate Actions Required

Update the Element Pack Addons for Elementor plugin to the version released in WordPress Changeset #3319668, which supersedes 8.0.0
Audit all Contributor, Author, and Editor accounts and remove or reset any that are unused or unverified
Review existing posts and pages for stored payloads in data-caption attributes and remove malicious content
Rotate administrator credentials and invalidate active sessions if exploitation is suspected

Patch Information

BDThemes addressed the issue in a release following version 8.0.0. The fix is published in WordPress Changeset #3319668 and documented in the BDThemes Announcements Category. Administrators should update through the WordPress plugin dashboard or by replacing the plugin files from the official WordPress Plugin Developer page.

Workarounds

Deactivate the Element Pack Addons for Elementor plugin until the update can be applied
Restrict Contributor-and-above capabilities so untrusted users cannot create or edit posts that render through the affected widgets
Deploy a Content Security Policy that disallows inline script execution on front-end pages
Add WAF signatures that block data-caption values containing HTML or JavaScript control characters

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate bdthemes-element-pack-lite

# After updating, verify the installed version
wp plugin get bdthemes-element-pack-lite --field=version