CVE-2025-8100 Overview
CVE-2025-8100 is a stored cross-site scripting (XSS) vulnerability in the Element Pack Elementor Addons and Templates plugin for WordPress. The flaw affects all versions up to and including 8.1.5. It resides in the marker_content parameter of the Open Street Map widget, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who visits a page containing the malicious marker content. The vulnerability is tracked under CWE-79 and impacts the bdthemes-element-pack-lite package distributed on the WordPress.org plugin repository.
Critical Impact
Authenticated contributors can persist JavaScript payloads that hijack sessions, steal credentials, or perform actions in the context of higher-privileged users, including administrators.
Affected Products
- Bdthemes Element Pack (Elementor Addons and Templates) versions up to and including 8.1.5
- bdthemes-element-pack-lite WordPress plugin distributions
- WordPress sites using the Open Street Map widget from Element Pack
Discovery Timeline
- 2025-08-06 - CVE-2025-8100 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-8100
Vulnerability Analysis
The vulnerability exists in the Open Street Map widget provided by the Element Pack plugin. The widget accepts user-supplied HTML for map marker content through the marker_content parameter. The plugin passes this content to the frontend rendering logic without adequate sanitization on input and without proper escaping on output. As a result, any JavaScript embedded in the marker content is rendered directly into the page DOM and executed by the visitor's browser.
Because the attack requires contributor-level authentication, the exploit is most impactful in multi-author WordPress environments where lower-privileged accounts can be provisioned or compromised. Successful exploitation enables session theft, forced administrative actions via CSRF chaining, redirection to attacker-controlled infrastructure, and injection of cryptomining or phishing content.
Root Cause
The root cause is missing input sanitization and output escaping in the Open Street Map widget rendering path. See the widget source at open-street-map.php line 498 and the client-side rendering at ep-open-street-map.js line 57. The marker_content value is inserted into map popup HTML rather than sanitized with WordPress helpers such as wp_kses_post() or escaped with esc_html().
Attack Vector
An attacker with contributor privileges edits a page or post that uses the Open Street Map widget and supplies a JavaScript payload in the marker_content field. Once the page is published or previewed by an administrator, editor, or site visitor, the payload executes in that user's browser under the site's origin. The scope is changed because the injected script runs in the context of higher-privileged users, enabling privilege escalation via account takeover.
No verified public exploit code is available. For technical detail, refer to the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-8100
Indicators of Compromise
- Elementor post meta entries (_elementor_data) containing <script> tags, javascript: URIs, or event handlers such as onerror= or onload= inside marker_content fields
- Unexpected outbound requests from browsers rendering pages that embed the Open Street Map widget
- New or modified administrator accounts created shortly after a contributor account edited a page containing the widget
- Browser console errors or Content Security Policy violations tied to inline scripts on pages using Element Pack
Detection Strategies
- Query the wp_postmeta table for _elementor_data values matching Open Street Map widgets and inspect marker_content fields for HTML tags or JavaScript syntax
- Enable WordPress audit logging to record post edits performed by contributor-level accounts on pages that render Element Pack widgets
- Deploy a web application firewall rule that inspects Elementor AJAX save requests for script tags in marker_content parameters
Monitoring Recommendations
- Monitor authenticated session activity for contributor accounts, focusing on post edits followed by administrator page views
- Alert on any Elementor widget save operation that includes HTML control characters within marker fields
- Track plugin version inventory across WordPress installations to identify hosts running Element Pack 8.1.5 or earlier
How to Mitigate CVE-2025-8100
Immediate Actions Required
- Update Element Pack Elementor Addons and Templates to a version later than 8.1.5 as published on the WordPress.org plugin repository
- Audit all contributor and author accounts, removing inactive users and enforcing multi-factor authentication for remaining accounts
- Review recent edits to pages using the Open Street Map widget and remove any marker_content values containing scripts or event handlers
Patch Information
The vendor addressed the issue in a plugin update tracked in the WordPress Plugin Changeset. Site administrators should install the latest release through the WordPress admin dashboard or via WP-CLI to remediate the flaw.
Workarounds
- Deactivate the Element Pack plugin until patching is possible if the Open Street Map widget is not required
- Restrict contributor and author roles from editing pages that contain Elementor widgets by adjusting capabilities through a role management plugin
- Deploy a Content Security Policy that disallows inline script execution to reduce the impact of stored XSS payloads
# Update Element Pack via WP-CLI to remediate CVE-2025-8100
wp plugin update bdthemes-element-pack-lite
wp plugin list --name=bdthemes-element-pack-lite --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
