CVE-2025-12830
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Description
The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Analysis
Stored cross-site scripting in Better Elementor Addons plugin for WordPress up to version 1.5.5 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript through insufficiently sanitized Slider widget attributes, which executes when any user views the affected page. This is a stored XSS vulnerability affecting a widely-deployed WordPress plugin; no public exploit code or active exploitation has been confirmed at time of analysis, but the low CVSS complexity (AC:L) and moderate EPSS exploitation probability make this a practical concern for any WordPress site running the vulnerable plugin versions with user roles permitted to edit pages.
Technical Context
The Better Elementor Addons plugin integrates custom widgets into the Elementor page builder ecosystem. The vulnerability resides in the Slider widget's style rendering components (style1.php, style2.php, style5.php) where user-supplied widget attributes are output directly into HTML/CSS contexts without proper escaping or sanitization. This is a classic CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') flaw-the application constructs dynamic HTML from user input intended for visual styling but fails to escape special characters that could break out of the attribute context and inject script tags or event handlers. WordPress plugins extending Elementor must sanitize inputs at the point of acceptance and escape outputs at the point of rendering; this plugin appears to have failed on the output escaping step, making stored XSS possible.
Affected Products
Better Elementor Addons for WordPress is affected in all versions up to and including 1.5.5. The plugin is distributed via the official WordPress.org plugin repository (https://wordpress.org/plugins/better-elementor-addons/). No CPE string is available from the provided data, but the vulnerability specifically impacts the Slider widget component across all affected releases. Sites running version 1.5.6 or later are no longer affected, assuming the patched version addresses the sanitization/escaping gaps.
Remediation
Update Better Elementor Addons to version 1.5.6 or later, which patches the insufficient input sanitization and output escaping issues in the Slider widget. The patch can be applied directly via the WordPress plugin update interface or by downloading the latest version from https://wordpress.org/plugins/better-elementor-addons/. Site administrators should verify the update completes successfully and test slider widgets post-upgrade. As a temporary workaround pending updates, restrict contributor-level access to page editing to trusted users only, or disable the Slider widget if it is not actively used. For further details, consult the Wordfence security advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d714d740-d7e0-49fd-af08-b4a80c9d0599.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today