CVE-2025-7644 Overview
CVE-2025-7644 is a Stored Cross-Site Scripting (XSS) vulnerability in the Pixel Gallery Addons for Elementor WordPress plugin. The plugin advertises Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, and Portfolio Gallery widgets. All versions up to and including 1.6.7 are affected due to insufficient input sanitization and output escaping on URL fields within all widgets.
Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes whenever a visitor loads the affected page, enabling session hijacking, redirection, or actions performed on behalf of authenticated administrators. The flaw is tracked under [CWE-79].
Critical Impact
Contributor-level accounts can plant persistent JavaScript that executes in the browsers of site visitors and administrators, enabling account takeover of higher-privileged users.
Affected Products
- Pixel Gallery Addons for Elementor plugin for WordPress
- All versions up to and including 1.6.7
- WordPress sites permitting Contributor-level or higher accounts
Discovery Timeline
- 2025-07-22 - CVE-2025-7644 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7644
Vulnerability Analysis
The vulnerability resides in URL input fields exposed across every widget shipped by the Pixel Gallery Addons plugin. The plugin accepts URL values from the Elementor editor and stores them in post meta without applying WordPress sanitization helpers such as esc_url_raw(). When the widget renders, the stored value is written into HTML attributes without esc_url() or esc_attr() output escaping.
This dual failure — missing input sanitization and missing output escaping — allows an attacker to break out of the intended attribute context. Payloads using the javascript: scheme or event handler injection execute in the browser of any user who loads the page.
Contributor-level users in WordPress cannot normally publish pages, but they can create draft content that editors and administrators review. When a higher-privileged user previews the draft, the stored script runs in their authenticated session.
Root Cause
The root cause is missing validation on URL parameters processed by the plugin's widget render callbacks. The plugin trusts the editor input and echoes it directly into href, src, and similar attributes. WordPress provides esc_url() specifically to strip dangerous schemes, but the plugin does not invoke it consistently across widgets.
Attack Vector
Exploitation requires an authenticated session with Contributor privileges or higher. The attacker creates or edits a page that uses any Pixel Gallery widget and supplies a crafted URL such as a javascript: payload or a value containing attribute-breaking characters. The payload persists in the database and triggers on every subsequent view.
Because the widget renders in the front-end context, the script inherits the browsing context of the victim, including any active administrator session cookies not marked HttpOnly. Refer to the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2025-7644
Indicators of Compromise
- Post meta or Elementor data containing URL values beginning with javascript:, data:, or containing <script>, onerror=, or onload= substrings.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages built with Pixel Gallery widgets.
- Contributor or Author accounts modifying pages that use gallery widgets outside of normal editorial workflow.
Detection Strategies
- Query the wp_postmeta table for Elementor data entries referencing Pixel Gallery widget keys and inspect stored URL values for non-http(s) schemes.
- Enable a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from post content.
- Review WordPress audit logs for Contributor-level accounts creating or editing pages that include gallery elements.
Monitoring Recommendations
- Alert on WordPress role assignments that grant Contributor or higher privileges to newly registered accounts.
- Monitor web server logs for repeated preview or draft-view requests targeting pages built with the affected plugin.
- Track plugin version inventory across managed WordPress installations to identify hosts running 1.6.7 or earlier.
How to Mitigate CVE-2025-7644
Immediate Actions Required
- Update the Pixel Gallery Addons for Elementor plugin to the version released after 1.6.7 that addresses this issue. Review the WordPress Plugin Changeset for the fix.
- Audit all pages built with Pixel Gallery widgets for suspicious URL values and remove any payloads found.
- Rotate session cookies and administrator passwords if evidence of exploitation exists.
Patch Information
The plugin author committed a fix in changeset 3328206 on the WordPress plugin repository. Site owners should upgrade to the patched release published after version 1.6.7. Confirm the running version under Plugins in the WordPress admin dashboard after upgrading.
Workarounds
- Restrict Contributor and Author roles to trusted users only until the patched version is deployed.
- Deactivate the Pixel Gallery Addons for Elementor plugin if immediate patching is not possible.
- Deploy a web application firewall rule that blocks requests containing javascript: schemes in Elementor data payloads.
- Enforce a strict Content Security Policy that disallows inline script execution on front-end pages.
# Configuration example
wp plugin update pixel-gallery
wp plugin list --name=pixel-gallery --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
