CVE-2025-8451: Essential Addons for Elementor XSS Vulnerability

CVE-2025-8451 Overview

CVE-2025-8451 affects the Essential Addons for Elementor plugin for WordPress, a widely deployed extension that provides templates and widgets for the Elementor page builder. The plugin is vulnerable to DOM-Based Stored Cross-Site Scripting through the data-gallery-items parameter in all versions up to and including 6.2.2. The flaw stems from insufficient input sanitization and output escaping in the filterable gallery widget. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts that execute in any user's browser when the injected page is viewed. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist malicious JavaScript in gallery widgets, enabling session theft, account takeover, and administrative privilege escalation when higher-privileged users view affected pages.

Affected Products

Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress
All versions up to and including 6.2.2
WordPress sites permitting Contributor-level or higher registration

Discovery Timeline

2025-08-15 - CVE-2025-8451 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8451

Vulnerability Analysis

The vulnerability resides in the filterable gallery widget shipped with Essential Addons for Elementor. The client-side JavaScript reads the data-gallery-items attribute and injects the value into the DOM without safe encoding. Because the payload is stored server-side in post content but rendered dynamically by client-side script, it qualifies as DOM-Based Stored XSS. Attackers holding Contributor privileges can embed the widget in draft or published content, poisoning the attribute with arbitrary markup and script.

When an administrator, editor, or anonymous visitor loads the affected page, the script executes in their browser session under the site's origin. The impact scope changes because malicious script crosses the boundary from Contributor content into higher-privilege browsing sessions, matching the scope change reflected in the CVSS vector.

Root Cause

The root cause is missing sanitization and output escaping in filterable-gallery.js. The script trusts the attribute payload and passes it to a DOM sink that interprets HTML, allowing <script> tags or event-handler attributes to execute. Server-side wp_kses filtering does not neutralize the payload because rendering happens in the client after the raw string reaches the DOM.

Attack Vector

Exploitation requires an authenticated account with at least Contributor privileges on the target WordPress instance. The attacker creates or edits a post that uses the Essential Addons filterable gallery, supplying a crafted data-gallery-items value. When the post is viewed, the payload executes in the visitor's browser, enabling cookie exfiltration, forced actions via administrator sessions, or persistent backdoor creation through the WordPress REST API. The data-gallery-items parameter is the primary sink; consult the WordPress Plugin JavaScript File for the vulnerable rendering logic.

Detection Methods for CVE-2025-8451

Indicators of Compromise

Post or page content containing filterable gallery blocks with data-gallery-items attributes that include <script>, onerror=, onload=, or javascript: payloads.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading pages built with Essential Addons.
New WordPress administrator accounts or modified wp_users and wp_usermeta records created without corresponding audit-log entries.
Contributor accounts editing posts that contain Elementor gallery widgets outside their normal authoring pattern.

Detection Strategies

Scan the wp_posts table for gallery shortcodes and attributes containing HTML event handlers or script tags in the post_content column.
Inspect browser Content Security Policy (CSP) violation reports for inline script executions originating from pages using the filterable gallery widget.
Correlate WordPress audit logs with edge web application firewall (WAF) telemetry to flag Contributor-level edits that introduce script-like tokens.
Compare deployed plugin versions against the fix delivered in WordPress Changeset #3344071.

Monitoring Recommendations

Alert on any content revisions that add gallery widgets with non-URL characters inside data-gallery-items values.
Monitor administrator session activity for XHR calls to /wp-json/wp/v2/users immediately following page views.
Track plugin inventory drift so unpatched WordPress hosts running Essential Addons for Elementor ≤ 6.2.2 are surfaced automatically.

How to Mitigate CVE-2025-8451

Immediate Actions Required

Update Essential Addons for Elementor to the version that incorporates WordPress Changeset #3344071 (a release above 6.2.2).
Audit all Contributor and Author accounts, disabling those that are inactive or unrecognized.
Review recent posts and revisions containing filterable gallery widgets and remove any that include suspicious data-gallery-items payloads.
Force password rotation and invalidate active sessions for administrators who may have viewed affected pages.

Patch Information

The maintainers addressed the flaw in a release above 6.2.2 by adding sanitization and safe DOM insertion for the data-gallery-items attribute. Full technical detail is available in the Wordfence Vulnerability Report and the upstream WordPress Changeset #3344071.

Workarounds

Restrict content creation privileges by removing the Contributor role from untrusted users until patching is complete.
Deploy a WAF rule that blocks POST requests to wp-admin/post.php containing HTML tag characters inside data-gallery-items values.
Enforce a strict Content Security Policy that disallows inline script execution site-wide to limit XSS impact.
Disable the Essential Addons filterable gallery widget in the plugin settings if it is not required.

bash

# Configuration example: block script-like payloads targeting the vulnerable attribute
# ModSecurity rule for WordPress edge proxies
SecRule ARGS_POST_NAMES "@rx post_content" \
    "chain,phase:2,id:1008451,deny,status:403,\
    msg:'CVE-2025-8451 Essential Addons XSS attempt'"
    SecRule ARGS:post_content "@rx data-gallery-items=\"[^\"]*(<script|onerror=|onload=|javascript:)" \
        "t:none,t:lowercase"