CVE-2025-8608: Elementor Yandex Maps XSS Vulnerability

CVE-2025-8608 Overview

CVE-2025-8608 is a Stored Cross-Site Scripting (XSS) vulnerability in the Mihdan: Elementor Yandex Maps plugin for WordPress. The flaw affects all versions up to and including 1.6.11. It stems from insufficient input sanitization and output escaping on user-supplied block attributes within the plugin widget. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when any visitor views the affected page. The issue is tracked under CWE-79 and was reported through the Wordfence vulnerability intelligence program.

Critical Impact
Authenticated contributors can inject persistent JavaScript into WordPress pages, enabling session theft, administrative action forgery, and site defacement against any visitor who loads the page.

Affected Products

Mihdan: Elementor Yandex Maps plugin for WordPress (all versions ≤ 1.6.11)
WordPress sites running Elementor with the vulnerable plugin installed
Fixed in version 1.7.0 of the plugin

Discovery Timeline

2025-09-30 - CVE-2025-8608 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8608

Vulnerability Analysis

The vulnerability resides in the Elementor widget rendering logic of the Mihdan: Elementor Yandex Maps plugin. The widget accepts attribute values supplied by authors when adding or editing a map block. The plugin passes these attributes to page output without applying WordPress sanitization helpers such as esc_attr(), esc_html(), or wp_kses(). Because contributor accounts can save post content with Elementor block attributes, a low-privileged user can embed a payload that becomes part of the stored page HTML. When any visitor, including administrators, loads the page, the browser executes the attacker-controlled script in the site's origin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The vulnerable rendering path in includes/class-widget.php around line 1437 writes attribute values directly into the rendered output. The patch in release 1.7.0 also renames _register_controls() to register_controls() in includes/class-acf-tag.php, aligning with current Elementor APIs that enforce stricter attribute handling.

Attack Vector

Exploitation requires an authenticated session at the contributor role or higher. The attacker edits a post or page using the Elementor editor, inserts the Yandex Maps block, and places a JavaScript payload inside a block attribute that is reflected into the DOM. After the post is saved and viewed, the stored script executes in the context of the WordPress site, giving the attacker access to cookies accessible to JavaScript, the DOM, and any administrative actions the viewing user can perform.

javascript

// Patch excerpt from frontend/js/mihdan-elementor-yandex-maps.js (release 1.7.0)
// Adds a guard that prevents duplicate initialization callbacks
setTimeout( lazyLoad, timeout );

if (w['ymaps_ready_' + map_id]) {
    return;
}

w['ymaps_ready_' + map_id] = function () {
    if ( 'yes' === ruler_control ) {
        // ...
    }
};
// Source: https://github.com/mihdan/mihdan-elementor-yandex-maps/commit/e1eabf80f5f29dd6b5a9eb8f01f74daab0256043

php

// Patch excerpt from includes/class-acf-tag.php (release 1.7.0)
// Switches to the public register_controls() method, aligning with Elementor
// APIs that apply current attribute handling
protected function register_controls() {
    $this->add_control(
        'fields',
        array(
            // ...
        )
    );
}
// Source: https://github.com/mihdan/mihdan-elementor-yandex-maps/commit/e1eabf80f5f29dd6b5a9eb8f01f74daab0256043

Detection Methods for CVE-2025-8608

Indicators of Compromise

Post or page revisions created by contributor-role accounts that include Yandex Maps blocks with <script>, onerror=, onload=, or javascript: substrings in attribute values.
Unexpected outbound requests from site visitors' browsers to attacker-controlled domains shortly after loading pages containing the plugin's widget.
New or modified administrator accounts following contributor edits to Elementor-based pages.

Detection Strategies

Audit the wp_posts and Elementor _elementor_data postmeta rows for Yandex Maps block attributes containing HTML control characters or on*= event handlers.
Review web server access logs for POST requests to admin-ajax.php and wp-json/wp/v2/posts originating from contributor accounts that modify pages containing the plugin.
Compare the installed plugin version against 1.7.0 using wp plugin list --name=mihdan-elementor-yandex-maps and flag any lower version.

Monitoring Recommendations

Enable WordPress audit logging to capture post edits, user role changes, and plugin configuration updates by non-administrator accounts.
Deploy Content Security Policy (CSP) headers with script-src restrictions and monitor CSP violation reports for inline script attempts.
Alert on creation of new accounts with elevated privileges within a short window after contributor post edits.

How to Mitigate CVE-2025-8608

Immediate Actions Required

Update the Mihdan: Elementor Yandex Maps plugin to version 1.7.0 or later on every WordPress instance where it is installed.
Review all pages containing the Yandex Maps widget authored by contributor or author accounts and remove any unexpected script content.
Rotate administrator session cookies and credentials if evidence of exploitation is found in audit logs.

Patch Information

The maintainer released version 1.7.0 with the fix in commit e1eabf8. See the GitHub commit, the vulnerable sink in WordPress Plugin Trac, and the Wordfence Vulnerability Report for details.

Workarounds

Deactivate the Mihdan: Elementor Yandex Maps plugin until the update to 1.7.0 can be applied.
Restrict contributor and author roles so only trusted users can edit pages that include the plugin's widget.
Enforce a Content Security Policy that blocks inline scripts and unapproved external script origins on affected sites.

bash

# Update the vulnerable plugin on a WordPress site using WP-CLI
wp plugin update mihdan-elementor-yandex-maps --version=1.7.0

# Verify the installed version is no longer vulnerable
wp plugin get mihdan-elementor-yandex-maps --field=version

# Optional: deactivate the plugin until the patch is validated in staging
wp plugin deactivate mihdan-elementor-yandex-maps