CVE-2025-3075

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3075", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-31T22:47:22.418Z", "datePublished": "2025-07-29T04:23:45.381Z", "dateUpdated": "2026-04-08T16:57:23.477Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:23.477Z"}, "affected": [{"vendor": "elemntor", "product": "Elementor Website Builder \u2013 more than just a page builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.29.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Elementor Website Builder \u2013 More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts sites with 'Element Caching' enabled."}], "title": "Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/639693b6-369e-457e-a37e-30bdb8ea7275?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3302102%40elementor&new=3302102%40elementor&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tonn"}], "timeline": [{"time": "2025-07-09T08:22:21.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-28T16:22:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-29T14:03:50.298721Z", "id": "CVE-2025-3075", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-29T14:03:55.782Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3075", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-29T14:03:50.298721Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-29T14:03:53.287Z"}}], "cna": {"title": "Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Tonn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "elemntor", "product": "Elementor Website Builder \u2013 More Than Just a Page Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.29.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-09T08:22:21.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-28T16:22:11.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/639693b6-369e-457e-a37e-30bdb8ea7275?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3302102%40elementor&new=3302102%40elementor&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Elementor Website Builder \u2013 More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts sites with 'Element Caching' enabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-29T04:23:45.381Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3075", "state": "PUBLISHED", "dateUpdated": "2025-07-29T14:03:55.782Z", "dateReserved": "2025-03-31T22:47:22.418Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-29T04:23:45.381Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Elementor Website Builder \u2013 more than just a page builder", "vendor": "elemntor", "versions": [{"lessThanOrEqual": "3.29.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elementor:website_builder:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "596098AE-1E87-4047-B6F8-BD3A38AD214D", "versionEndExcluding": "3.29.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Elementor Website Builder \u2013 More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts sites with 'Element Caching' enabled."}, {"lang": "es", "value": "El complemento Elementor Website Builder \u2013 More Than Just Page Builder para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del shortcode \"elementor-element\" del complemento en todas las versiones hasta la 3.29.0 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada. Esto solo afecta a los sitios con 'Element Caching' habilitado."}], "id": "CVE-2025-3075", "lastModified": "2026-06-17T09:19:08.957", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3075", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-29T14:03:50.298721Z", "version": "2.0.3"}}]}, "published": "2025-07-29T05:15:29.840", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3302102%40elementor&new=3302102%40elementor&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/639693b6-369e-457e-a37e-30bdb8ea7275?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:34:17.900260+00:00", "value": {"mitigation_remediation": ["Upgrade Elementor to version 3.30.0 or later", "Disable the Element Caching feature in the Elementor settings", "Remove or replace any stored shortcode instances that contain user\u2011supplied attributes with sanitized content"], "summary": {"action": "Patch", "impact": "Stored cross-site scripting via Elementor shortcode"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Elementor Website Builder plugin, version 3.29.0 or earlier, that have Element Caching activated.", "description_and_impact": "The Elementor Website Builder plugin for WordPress is vulnerable to a stored cross\u2011site scripting flaw in the \u2018elementor-element\u2019 shortcode up to and including version 3.29.0. The flaw arises from insufficient input sanitization and output escaping on user\u2011supplied attributes, allowing an attacker who has contributor\u2011level or higher access to inject arbitrary JavaScript into page content. The injected scripts execute whenever any user views the affected page, potentially allowing cookie theft, session hijacking, or defacement. Only sites with Elementor\u2019s \u2018Element Caching\u2019 enabled are impacted, as cached pages may persist the injected payload.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog, but it requires authenticated access at the contributor level or higher. Once exploited, the attacker can execute arbitrary code in the context of a victim\u2019s browser, potentially compromising user sessions and site integrity."}}}}, "created": "2025-07-29T10:00:56.576909+00:00", "updated": "2026-04-21T19:45:16.072678+00:00", "vendors": ["elementor", "elementor$PRODUCT$elementor", "elementor$PRODUCT$elementor_page_builder", "elementor$PRODUCT$elementor_website_builder", "elementor$PRODUCT$page_builder", "elementor$PRODUCT$website_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}