What is the CVSS score of CVE-2025-6686?

CVE-2025-6686 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Magic Buttons for Elementor CVE-2025-6686

EUVD-2025-19682 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-07-02 security@wordfence.com

WordPress XSS Magic Buttons For Elementor Wordpress Plugin Pwrplugins

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Requires contributor-level auth (PR:L), no user interaction (UI:N), scope change (S:C) as impact is on user's session.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 20:23 vuln.today

EUVD ID Assigned

Mar 16, 2026 - 01:55 euvd

EUVD-2025-19682

CVE Published

Jul 02, 2025 - 04:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting vulnerability in the Magic Buttons for Elementor WordPress plugin allows authenticated attackers with contributor-level access to inject arbitrary web scripts via the magic-button shortcode. The flaw exists in all versions up to and including 1.0 due to insufficient input sanitization. No public exploit has been identified, and EPSS score is very low (0.03%), indicating minimal exploitation risk at this time.

Technical ContextAI

The vulnerability is a stored Cross-Site Scripting (XSS) classified under CWE-79, originating from inadequate sanitization of user-supplied attributes in the plugin's shortcode magic-button. The affected component is the WordPress plugin 'Magic Buttons for Elementor' (CPE: cpe:2.3:a:pwrplugins:magic_buttons_for_elementor:*:*:*:*:*:wordpress:*:*), which extends the Elementor page builder with custom button functionality. The shortcode accepts attributes that are not properly escaped before rendering, allowing injection of malicious HTML/JavaScript.

RemediationAI

Update the Magic Buttons for Elementor plugin to version 1.0.1 or later. The fix is available via the WordPress plugin repository; the patch commit can be found at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3333894%40magic-buttons-for-elementor&new=3333894%40magic-buttons-for-elementor. If updating is not immediately possible, restrict contributor-level access to trusted users only, as the vulnerability requires authenticated access. Note that limiting contributor roles may impact normal workflow; no other workaround is available.