CVE-2025-1458

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1458", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-18T20:09:14.285Z", "datePublished": "2025-04-26T05:34:23.210Z", "dateUpdated": "2026-04-08T17:03:25.162Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:25.162Z"}, "affected": [{"vendor": "bdthemes", "product": "Element Pack \u2013 Widgets, Templates & Addons for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.10.29", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Element Pack Addons for Elementor \u2013 Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbd3170-a45b-4ae6-bc59-4cfb92f6c2a6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3277466%40bdthemes-element-pack-lite&new=3277466%40bdthemes-element-pack-lite&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-04-25T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-28T14:46:40.420107Z", "id": "CVE-2025-1458", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-28T21:56:10.556Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1458", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-28T14:46:40.420107Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-28T14:46:41.709Z"}}], "cna": {"title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "bdthemes", "product": "Element Pack \u2013 Widgets, Templates & Addons for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.10.29"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-25T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbd3170-a45b-4ae6-bc59-4cfb92f6c2a6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3277466%40bdthemes-element-pack-lite&new=3277466%40bdthemes-element-pack-lite&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Element Pack Addons for Elementor \u2013 Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:25.162Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1458", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:25.162Z", "dateReserved": "2025-02-18T20:09:14.285Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-26T05:34:23.210Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Element Pack \u2013 Widgets, Templates & Addons for Elementor", "vendor": "bdthemes", "versions": [{"lessThanOrEqual": "5.10.29", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bdthemes:element_pack:*:*:*:*:lite:wordpress:*:*", "matchCriteriaId": "F90E61E1-33D4-4B16-A497-CC07A61F8A4D", "versionEndExcluding": "5.10.30", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Element Pack Addons for Elementor \u2013 Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Element Pack Addons for Elementor \u2013 Free Templates and Widgets for Your WordPress Websites para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de varios widgets como el Bot\u00f3n Dual, el Bot\u00f3n Creativo, la Pila de Im\u00e1genes y m\u00e1s, en todas las versiones hasta la 5.10.29 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de Colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-1458", "lastModified": "2026-06-17T08:39:10.383", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1458", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-28T14:46:40.420107Z", "version": "2.0.3"}}]}, "published": "2025-04-26T06:15:14.407", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3277466%40bdthemes-element-pack-lite&new=3277466%40bdthemes-element-pack-lite&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbd3170-a45b-4ae6-bc59-4cfb92f6c2a6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T08:07:23.292330+00:00", "value": {"mitigation_remediation": ["Update the Element Pack plugin to a fixed version that corrects the stored XSS flaw.", "Disable the vulnerable widgets (e.g., Dual Button, Creative Button, Image Stack) on all impacted pages until an update is available.", "Restrict Contributor and higher permissions to trusted users only, or remove these privileges from users that do not need to edit widget settings to limit the opportunity for script injection."], "summary": {"action": "Patch Now", "impact": "Stored Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "All released versions of the bdthemes Element Pack Lite plugin for Elementor up to and including version 5.10.29 are affected. A WordPress site that has installed this plugin with any of the vulnerable widgets enabled is susceptible; the flaw does not extend to other Elementor add\u2011on packages that do not contain these widgets.", "description_and_impact": "The Element Pack Addons for Elementor plugin contains a stored cross\u2011site scripting flaw that allows an authenticated user with Contributor or higher privileges to inject arbitrary scripts via widgets such as Dual Button, Creative Button, and Image Stack. The vulnerability arises from insufficient input sanitization and output escaping, causing malicious code to be stored in the database and executed when a user views the impacted page.", "risk_and_exploitability": "The CVSS score of 6.4 classifies the vulnerability as moderate, while an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Attackers must be authenticated with Contributor\u2011level or higher privileges, so they are typically limited to users who have editing rights within the Elementor editor. Once authenticated, the attacker can embed malicious scripts that run in the browsers of all users who view the affected page, potentially allowing execution of further payloads."}}}}, "created": "2026-04-22T08:15:05.753924+00:00", "updated": "2026-04-22T08:15:05.753935+00:00", "vendors": []}