CVE-2025-1458
📋 TL;DR
This stored XSS vulnerability in the Element Pack Addons for Elementor WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject malicious scripts into website pages. These scripts execute whenever users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Element Pack Addons for Elementor WordPress plugin
📦 What is this software?
Element Pack by Bdthemes
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with contributor accounts inject malicious scripts that steal user session cookies or perform unauthorized actions on behalf of users.
If Mitigated
With proper user access controls and input validation, impact is limited to isolated script execution without privilege escalation.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once attacker has contributor-level credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.10.30 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Element Pack Addons for Elementor'. 4. Click 'Update Now' if available. 5. If no update shows, download version 5.10.30+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable widgets
allTemporarily disable affected widgets (Dual Button, Creative Button, Image Stack) via Elementor settings
Restrict user roles
allTemporarily remove Contributor role access or restrict to trusted users only
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to limit script execution
- Install web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Element Pack Addons for Elementor → Version number. If version is 5.10.29 or lower, you are vulnerable.Check Version:
wp plugin list --name='Element Pack Addons for Elementor' --field=versionVerify Fix Applied:
After updating, verify version shows 5.10.30 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to Elementor widget endpoints
- Suspicious script tags in page content from contributor users
Network Indicators:
- Unexpected script loads from WordPress pages
- Suspicious outbound connections from user browsers
SIEM Query:
source="wordpress.log" AND ("element-pack" OR "bdthemes") AND (POST OR UPDATE) AND ("button" OR "widget")