CVE-2025-7440: Anber Elementor Addon XSS Vulnerability

CVE-2025-7440 is a stored cross-site scripting vulnerability in the Anber Elementor Addon plugin for WordPress affecting versions up to 1.0.1. Attackers with Contributor access can inject malicious scripts that execute when users view compromised pages. This article covers technical details, affected versions, security impact, and recommended mitigation strategies.

CVE-2025-7440 Overview

The Anber Elementor Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to and including 1.0.1. The flaw exists in the $item['button_link']['url'] parameter due to insufficient input sanitization and output escaping. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure.

Critical Impact
Contributor-level attackers can persistently inject JavaScript that executes against site visitors and administrators, enabling account takeover and content manipulation.

Affected Products

Anber Elementor Addon plugin for WordPress, versions up to and including 1.0.1
WordPress sites using Elementor with the Anber Addon extension
Any site permitting Contributor-level user registration with this plugin active

Discovery Timeline

2025-08-16 - CVE-2025-7440 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7440

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. The plugin accepts a URL value through the $item['button_link']['url'] parameter used to construct button link elements in the Elementor page builder. The plugin fails to sanitize this input on save and does not escape the value when it renders inside HTML output.

An authenticated attacker with Contributor privileges can submit a crafted payload as the button link. WordPress stores the malicious value in the post metadata. When any visitor loads the resulting page, the browser parses and executes the injected script in the context of the site's origin.

Because the payload persists in the database, exploitation does not require social engineering or crafted links. Every visitor who views the affected content triggers the payload, including administrators reviewing submitted content.

Root Cause

The plugin trusts author-supplied URL data without applying WordPress sanitization APIs such as esc_url_raw() on input or esc_url() and esc_attr() on output. Attribute contexts that include javascript: schemes or event handler payloads execute when rendered without proper escaping.

Attack Vector

Exploitation requires network access to the WordPress admin interface and an authenticated Contributor account. The attacker edits a post or page containing an Anber button widget and supplies a JavaScript payload as the button URL. The stored value renders in the front-end HTML, and the scope-changed impact affects any user who loads the page.

The vulnerability mechanism is described in prose because no verified proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-7440

Indicators of Compromise

Post or page meta values containing <script>, javascript:, or event handler attributes such as onerror= and onload= in button URL fields
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages with Anber button widgets
New or modified administrator accounts created shortly after a Contributor edited a page
Elementor page revisions authored by low-privilege users that include non-URL characters in link fields

Detection Strategies

Query the wp_postmeta table for Elementor data referencing button_link values that do not begin with http://, https://, or /
Review web server access logs for requests to pages authored by Contributor accounts that trigger unusual referrer or JavaScript activity
Enforce a Content Security Policy in report-only mode to surface inline script execution on pages using the plugin

Monitoring Recommendations

Alert on creation or modification of posts by Contributor-level users when Anber widgets are present
Monitor administrator sessions for unexpected requests originating from post preview or edit views
Track plugin file integrity for the anber-elementor-addon directory to detect tampering

How to Mitigate CVE-2025-7440

Immediate Actions Required

Deactivate the Anber Elementor Addon plugin until a patched release is confirmed installed
Audit existing posts and pages for malicious payloads stored in button URL fields and remove them
Restrict Contributor account creation and review recently registered low-privilege accounts
Rotate credentials for any administrator who previewed or edited pages containing untrusted content

Patch Information

At the time of NVD publication, no fixed version had been indicated for the Anber Elementor Addon plugin. Monitor the official plugin page on WordPress.org and the Wordfence Vulnerability Report for release information and upgrade to a version above 1.0.1 once available.

Workarounds

Remove Contributor and Author role assignments from untrusted users while the plugin remains installed
Deploy a web application firewall rule that blocks javascript: schemes and script tags in POST parameters targeting admin-ajax.php and the REST API
Apply a strict Content Security Policy that disallows inline scripts on front-end pages
Replace the Anber Elementor Addon with an alternative widget pack that properly escapes URL input

bash

# Example CSP header to reduce stored XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"