CVE-2025-6687: Magic Buttons For Elementor XSS Vulnerability

CVE-2025-6687 Overview

CVE-2025-6687 is a Stored Cross-Site Scripting (XSS) vulnerability in the Magic Buttons for Elementor plugin for WordPress. The flaw affects all versions up to and including 1.0. It resides in the plugin's magic-button shortcode, which fails to sanitize the user-supplied icon attribute and does not escape the value on output. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits an affected page. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Contributor-level users can persist JavaScript payloads inside published pages, enabling session theft, forced administrative actions, and cross-user compromise when visitors render the injected content.

Affected Products

Pwrplugins Magic Buttons for Elementor (WordPress plugin)
All versions through 1.0
Sites using the plugin's magic-button shortcode

Discovery Timeline

2025-07-02 - CVE-2025-6687 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6687

Vulnerability Analysis

The Magic Buttons for Elementor plugin exposes a shortcode named magic-button that accepts several user-controlled attributes to render icon buttons. Among these, the icon attribute is written directly into the generated HTML without proper sanitization or output escaping. Because WordPress shortcodes are evaluated when a page is rendered, malicious values persist inside post content and re-execute on every visit. The scope change reflected in the vector shows that injected scripts run in the context of the rendering page, affecting other authenticated users, including administrators who preview or edit content.

Root Cause

The underlying defect is missing input validation and output escaping in the shortcode handler defined in magic_buttons_shortcodes.php. Attribute values passed to the shortcode should be filtered with WordPress helpers such as esc_attr(), esc_html(), or sanitize_text_field() before being embedded in HTML. The plugin instead concatenates the raw icon value into the button markup, allowing arbitrary attributes, event handlers, or <script> tags to persist in stored content.

Attack Vector

Exploitation requires an authenticated account at contributor level or higher on the target WordPress site. The attacker creates or edits a post containing the magic-button shortcode and supplies a crafted icon value that breaks out of the intended attribute context. Once the post is published or previewed by a higher-privileged user, the injected JavaScript executes with that user's session. Impact scenarios include stealing authentication cookies, performing CSRF-style administrative actions, injecting persistent backdoors into themes or plugins, and redirecting site visitors. User interaction is required because a victim must load the affected page. See the Wordfence Vulnerability Report and the WordPress Plugin Shortcodes source for the vulnerable handler.

Detection Methods for CVE-2025-6687

Indicators of Compromise

Posts, pages, or Elementor templates containing magic-button shortcodes whose icon attribute includes angle brackets, javascript: URIs, on*= event handlers, or encoded script fragments.
Unexpected outbound requests from browser sessions of administrators shortly after viewing content authored by contributor accounts.
New administrator accounts, plugin installations, or theme file modifications following contributor activity.

Detection Strategies

Query the wp_posts table for post_content values matching [magic-button combined with suspicious characters such as <, ", onerror, or onload in the icon attribute.
Review WordPress audit logs for contributor-role accounts creating or editing posts that use the magic-button shortcode.
Inspect rendered HTML of published pages for script content that does not match the plugin's expected icon markup.

Monitoring Recommendations

Enable a WordPress activity logging plugin to track shortcode use, post revisions, and role changes by contributor-level accounts.
Monitor web server access logs for anomalous requests originating from administrator sessions after page loads containing the shortcode.
Alert on installation of new plugins, changes to wp_users, or edits to theme files that follow contributor content submissions.

How to Mitigate CVE-2025-6687

Immediate Actions Required

Deactivate the Magic Buttons for Elementor plugin until a patched version is confirmed available.
Audit all posts and Elementor templates for existing magic-button shortcodes and remove or sanitize suspicious icon attribute values.
Restrict contributor and author account creation, and review the trust level of existing low-privileged accounts.
Force password resets for administrator accounts that may have loaded affected content.

Patch Information

No vendor-supplied fixed version is listed in the NVD entry at time of publication. Review the WordPress Plugin Changeset and the WordPress plugin developer page for updates. Apply the latest release once the vendor confirms proper escaping of the icon attribute in magic_buttons_shortcodes.php.

Workarounds

Remove or disable the magic-button shortcode via a custom mu-plugin that calls remove_shortcode('magic-button') until a patch is applied.
Use a web application firewall rule to block POST requests to /wp-admin/post.php containing [magic-button with characters such as <, ", or javascript: in the icon value.
Downgrade contributor-role users to subscriber-level access if their ability to publish shortcode-bearing content is not required.

bash

# Configuration example: disable the vulnerable shortcode via mu-plugin
# File: wp-content/mu-plugins/disable-magic-button.php
<?php
add_action('init', function () {
    if (shortcode_exists('magic-button')) {
        remove_shortcode('magic-button');
    }
}, 20);