CVE-2025-8564: SKT Addons for Elementor XSS Vulnerability

CVE-2025-8564 Overview

CVE-2025-8564 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the SKT Addons for Elementor plugin for WordPress. The flaw exists in multiple widgets across all versions up to and including 3.7. The root cause is insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. The injected payload executes in the browser of any visitor who loads the affected page. This weakness is categorized as [CWE-79].

Critical Impact
Contributor-level users can inject persistent JavaScript that runs in every visitor's browser, enabling session theft, credential harvesting, and administrative account takeover through DOM-based actions.

Affected Products

SKT Addons for Elementor plugin for WordPress (all versions up to and including 3.7)
WordPress sites running Elementor with SKT Addons enabled
Multiple widgets shipped by the plugin that accept user-supplied attributes

Discovery Timeline

2025-09-06 - CVE-2025-8564 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8564

Vulnerability Analysis

The SKT Addons for Elementor plugin exposes multiple widgets inside the Elementor page builder. Each widget accepts attribute values that content authors configure through the editor UI. The plugin renders these attributes back into the page output without applying WordPress sanitization functions such as esc_attr(), esc_html(), or wp_kses(). An attacker with contributor privileges can craft widget attributes containing JavaScript payloads. When an administrator, editor, or site visitor loads the resulting page, the script executes in their browser session. The scope is marked changed because the injected script runs in the context of the WordPress site origin, not the plugin's own trust boundary.

Root Cause

The defect stems from missing input validation on widget attributes and missing output escaping when the widgets render HTML. WordPress provides context-aware escaping helpers, but the vulnerable widget templates concatenate raw attribute values directly into HTML output. This violates the [CWE-79] pattern of neutralizing input during web page generation.

Attack Vector

Exploitation requires an authenticated account with contributor role or higher. The attacker creates or edits a post, drags a vulnerable SKT Addons widget onto the page, and supplies a malicious value in a widget attribute such as a title, link, or icon field. Once the post is previewed or published, the payload triggers on every page load. Because contributor accounts can typically be self-registered on many WordPress deployments, the barrier to abuse is low. See the Wordfence Vulnerability Report for widget-level detail.

The vulnerability manifests inside the affected widget render functions. Refer to the WordPress Plugin Changeset for the specific code paths and remediation diff.

Detection Methods for CVE-2025-8564

Indicators of Compromise

Post or page content containing <script>, onerror=, onload=, or javascript: strings inside SKT Addons widget attributes stored in wp_postmeta.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages built with SKT Addons widgets.
New administrator accounts, changed user emails, or modified wp_options values shortly after a contributor account edited a page.

Detection Strategies

Query the WordPress database for _elementor_data meta values containing script tags or event-handler attributes tied to SKT Addons widget identifiers.
Deploy a web application firewall rule that inspects POST requests to admin-ajax.php and wp-json endpoints for XSS payloads in Elementor widget payloads.
Review contributor and author account activity logs for post revisions that add SKT Addons widgets or modify widget attributes.

Monitoring Recommendations

Enable WordPress audit logging to record post edits, user role changes, and plugin configuration updates.
Forward WordPress and web server logs to a centralized platform and alert on Content Security Policy violation reports from published pages.
Track plugin version inventory across all WordPress sites and flag any host still running SKT Addons for Elementor 3.7 or earlier.

How to Mitigate CVE-2025-8564

Immediate Actions Required

Update SKT Addons for Elementor to the latest patched release available on the plugin page.
Audit all existing posts and pages that use SKT Addons widgets for stored payloads and remove or sanitize suspicious attribute values.
Review and restrict contributor and author accounts, disabling self-registration where it is not required.

Patch Information

The vendor addressed the issue in a plugin update tracked in the WordPress Plugin Changeset. Site administrators should install the fixed version through the WordPress plugin updater or by replacing the plugin files with the patched release.

Workarounds

Deactivate and remove SKT Addons for Elementor until the patched version is deployed.
Enforce a strict Content Security Policy that blocks inline scripts and unapproved script sources on all WordPress front-end pages.
Restrict the contributor and author roles from using SKT Addons widgets by adjusting Elementor role manager settings.

bash

# WP-CLI commands to inventory and update the vulnerable plugin
wp plugin get skt-addons-for-elementor --field=version
wp plugin update skt-addons-for-elementor
wp user list --role=contributor --field=user_login