CVE-2025-8388 Overview
CVE-2025-8388 is a stored cross-site scripting (XSS) vulnerability in the PowerPack Elementor Addons plugin for WordPress. The flaw exists in the cursor_url parameter of the plugin's Custom Cursor extension. All versions up to and including 2.9.4 are affected due to insufficient input sanitization and output escaping [CWE-79].
Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when any visitor loads the affected page. The vulnerability enables session theft, redirection, and administrator account takeover through payload execution in privileged browser sessions.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser of any user viewing the page, including administrators.
Affected Products
- PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress
- All versions up to and including 2.9.4
- The custom-cursor.php extension component
Discovery Timeline
- 2025-09-10 - CVE-2025-8388 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-8388
Vulnerability Analysis
The PowerPack Elementor Addons plugin provides a Custom Cursor extension that allows page authors to specify a custom cursor image via a URL parameter. The plugin accepts a cursor_url value from the Elementor editor and writes it into rendered page markup without adequate sanitization or output escaping.
Contributor-level accounts in WordPress can create and edit posts but normally cannot publish or execute scripts. This vulnerability bypasses that boundary by persisting attacker-controlled content into page output. When an editor or administrator previews or reviews the submitted content, the injected script executes in their authenticated session context.
The attack scope is changed because a low-privileged contributor can affect users with higher privileges. Successful exploitation supports session hijacking, forced administrative actions through the REST API, and delivery of secondary payloads to site visitors.
Root Cause
The root cause is missing output escaping on the cursor_url field within the Custom Cursor extension. Reference the affected function in custom-cursor.php at line 402. The plugin treats the stored value as a trusted URL rather than an untrusted string requiring esc_url or equivalent escaping before rendering into HTML attributes.
Attack Vector
An attacker authenticates to WordPress with a Contributor account. The attacker edits or creates content that uses the PowerPack Custom Cursor feature and supplies a malicious payload in the cursor_url parameter. The payload persists in the post metadata. When any user, including an administrator, loads the page, the browser parses the injected script and executes it under the site origin. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-8388
Indicators of Compromise
- Post or page metadata containing cursor_url values with javascript:, data:, or embedded HTML event handlers such as onerror and onload.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting plugin-rendered pages.
- New administrator accounts, modified user roles, or plugin installations occurring soon after Contributor-level activity.
Detection Strategies
- Audit the WordPress postmeta table for PowerPack Custom Cursor entries and inspect stored cursor_url values for non-URL content.
- Deploy web application firewall rules that block script fragments and event-handler attributes in plugin AJAX save requests.
- Correlate low-privilege user content edits with subsequent administrator session anomalies in access logs.
Monitoring Recommendations
- Enable WordPress audit logging to record Contributor-level post creation, edit events, and metadata changes.
- Monitor for the plugin version string across WordPress instances and flag hosts still running 2.9.4 or earlier.
- Alert on browser telemetry showing script execution originating from post content DOM nodes on authenticated admin sessions.
How to Mitigate CVE-2025-8388
Immediate Actions Required
- Update the PowerPack Elementor Addons plugin to the version that includes WordPress Changeset #3357005 or later.
- Review Contributor and Author accounts and remove any that are unrecognized or inactive.
- Inspect existing posts and pages using the Custom Cursor feature for injected payloads and remove malicious content.
Patch Information
The vendor addressed the vulnerability in the PowerPack Elementor Addons plugin release following changeset 3357005. The fix applies proper output escaping to the cursor_url parameter before rendering it into page markup. Administrators should install the patched release through the WordPress plugin updater and confirm the plugin version is greater than 2.9.4.
Workarounds
- Restrict the Contributor and Author roles until the plugin is patched, granting content submission only to trusted users.
- Disable the PowerPack Custom Cursor extension in the plugin settings if the feature is not required.
- Deploy a Content Security Policy that restricts inline script execution and limits allowed script sources on public pages.
# Verify installed plugin version and update via WP-CLI
wp plugin get powerpack-lite-for-elementor --field=version
wp plugin update powerpack-lite-for-elementor
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
