CVE-2025-13196

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13196", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-14T15:55:22.425Z", "datePublished": "2025-11-18T09:27:36.191Z", "dateUpdated": "2026-04-08T16:35:18.416Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:18.416Z"}, "affected": [{"vendor": "bdthemes", "product": "Element Pack \u2013 Widgets, Templates & Addons for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.3.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Street Map widget's marker content parameter in all versions up to, and including, 8.3.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the render function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0da6a080-260f-4b19-a32c-453d2781389a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3396544%40bdthemes-element-pack-lite&old=3395028%40bdthemes-element-pack-lite&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-11-06T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-14T16:12:36.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-17T20:54:12.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T21:32:58.756008Z", "id": "CVE-2025-13196", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:33:06.846Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13196", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T21:32:58.756008Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:33:02.807Z"}}], "cna": {"title": "Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "bdthemes", "product": "Element Pack Addons for Elementor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "8.3.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-06T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-14T16:12:36.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-17T20:54:12.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0da6a080-260f-4b19-a32c-453d2781389a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3396544%40bdthemes-element-pack-lite&old=3395028%40bdthemes-element-pack-lite&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Street Map widget's marker content parameter in all versions up to, and including, 8.3.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the render function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-18T09:27:36.191Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13196", "state": "PUBLISHED", "dateUpdated": "2025-11-18T21:33:06.846Z", "dateReserved": "2025-11-14T15:55:22.425Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T09:27:36.191Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Element Pack \u2013 Widgets, Templates & Addons for Elementor", "vendor": "bdthemes", "versions": [{"lessThanOrEqual": "8.3.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Street Map widget's marker content parameter in all versions up to, and including, 8.3.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the render function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Element Pack Addons para Elementor para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro de contenido del marcador del widget Open Street Map en todas las versiones hasta la 8.3.4, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario en la funci\u00f3n de renderizado. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13196", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13196", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T21:32:58.756008Z", "version": "2.0.3"}}]}, "published": "2025-11-18T10:15:49.620", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3396544%40bdthemes-element-pack-lite&old=3395028%40bdthemes-element-pack-lite&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0da6a080-260f-4b19-a32c-453d2781389a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T22:50:37.134587+00:00", "value": {"mitigation_remediation": ["Upgrade Element Pack to version 8.3.5 or later, which removes the flaw through proper input sanitization and output escaping.", "Restrict contributor-level access from inserting widgets or disable the Open Street Map widget for contributors and lower roles.", "Conduct a review of existing pages to detect and remove any injected marker content, and monitor for unauthorized changes."], "summary": {"action": "Apply Patch", "impact": "Stored XSS"}, "threat_synthesis": {"affected_systems": "The affected product is bdthemes:Element Pack\u00a0\u2013 Widgets, Templates & Addons for Elementor, a popular WordPress plugin that extends Elementor. All versions of Element Pack up to and including 8.3.4 contain the flaw; the plugin is widely used on sites that run WordPress and Elementor. No specific operating system or PHP version is mentioned, but any WordPress installation using a vulnerable version of this plugin is at risk.", "description_and_impact": "The vulnerability allows an attacker who can authenticate to the WordPress site with contributor level access or higher to store malicious scripts in the marker content field of the Open Street Map widget. When a user views a page that includes that widget, the injected script executes in the victim's browser. This is a classic stored cross\u2011site scripting flaw\u2014CWE\u201179\u2014providing an attacker with client\u2011side code execution that can lead to defacement, cookie theft, or further phishing attacks, but not to unrestricted server\u2011side code execution. The impact is therefore limited to client\u2011side compromise rather than full system takeover.", "risk_and_exploitability": "The CVSS score of 5.4 classifies the flaw as a moderate severity issue, but the very low EPSS score of <1% indicates that, at the time of analysis, the probability of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access, an attacker would need to compromise a contributor\u2011level account or gain it through phishing or credential reuse. Once authenticated, they can inject the payload and any person who later opens a page containing the malicious widget will be affected. The attack vector is therefore constrained to sites with the vulnerable plugin and to users who view the injected pages."}}}}, "created": "2025-11-19T10:48:03.253256+00:00", "updated": "2026-04-27T23:00:13.967790+00:00", "vendors": ["bdthemes", "bdthemes$PRODUCT$element_pack", "bdthemes$PRODUCT$element_pack_elementor_addons", "wordpress", "wordpress$PRODUCT$wordpress"]}