CoreCVE
Back

MEDIUM

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published Aug 1, 2025

Description

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter in all versions up to, and including, 6.3.10 even when the user does not have the unfiltered_html capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Wordfence
Published Aug 1, 2025
Updated Apr 8, 2026
Reserved Jul 14, 2025
Link CVE-2025-7646

CISA Vulnrichment

Updated Aug 1, 2025

NVD

Status Deferred
Modified Jun 17, 2026
Link CVE-2025-7646

Red Hat

No data

ENISA EUVD

Assigner Wordfence
Published Aug 1, 2025
Updated Apr 8, 2026
Link EUVD-2025-23345

GitHub

No data