CVE-2025-5290 – The Borderless Elementor Addons plugin for Word... (How to Fix)

Q: What is the severity of CVE-2025-5290?

CVE-2025-5290 has a CVSS score of 6.4 (MEDIUM). The Borderless Elementor Addons plugin for WordPress has a stored XSS vulnerability in the 'title' parameter. Authenticated attackers with Contributor access or higher can inject malicious scripts that execute when users view compromised pages. This affects all versions up to 1.7.1.

📋 TL;DR

The Borderless Elementor Addons plugin for WordPress has a stored XSS vulnerability in the 'title' parameter. Authenticated attackers with Contributor access or higher can inject malicious scripts that execute when users view compromised pages. This affects all versions up to 1.7.1.

💻 Affected Systems

Products:

Borderless – Elementor Addons and Templates

Versions: All versions up to and including 1.7.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with Elementor and the Borderless plugin installed. Contributor-level access or higher is needed to exploit.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal admin credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.

🟠

Likely Case

Attackers inject malicious scripts to steal user session cookies, perform actions on behalf of users, or display unwanted content.

🟢

If Mitigated

With proper input validation and output escaping, the vulnerability would be prevented, and only sanitized content would be displayed.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once an attacker has Contributor privileges.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 1.7.2 or later

Vendor Advisory: https://plugins.trac.wordpress.org/browser/borderless

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Borderless – Elementor Addons and Templates'. 4. Click 'Update Now' if available, or manually update via FTP/SSH. 5. Verify the plugin version is 1.7.2 or higher.

🔧 Temporary Workarounds

Remove Contributor Access

all

Temporarily restrict Contributor-level user roles to prevent exploitation.

Disable Plugin

linux

Deactivate the Borderless plugin until patched.

wp plugin deactivate borderless

🧯 If You Can't Patch

Implement strict input validation and output escaping in custom code.
Use a web application firewall (WAF) to block XSS payloads.

🔍 How to Verify

Check if Vulnerable:

Check the plugin version in WordPress admin under Plugins > Installed Plugins. If version is 1.7.1 or lower, it is vulnerable.

Check Version:

wp plugin get borderless --field=version

Verify Fix Applied:

After updating, confirm the plugin version is 1.7.2 or higher in the WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to plugin endpoints with script tags in parameters.
Multiple failed login attempts followed by successful Contributor-level access.

Network Indicators:

Inbound traffic with JavaScript payloads in 'title' parameter to plugin-related URLs.

SIEM Query:

source="wordpress.log" AND ("borderless" OR "elementor") AND ("script" OR "onerror" OR "javascript:")

📊 Metadata

CVE ID: CVE-2025-5290

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.09% exploit probability (24.9th percentile)

Published: May 31, 2025

Last Updated: June 2, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-5290, you might also want to check these: