CVE-2025-14163: Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'
The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11.53. This is due to missing nonce validation in the 'insertinnertemplate' function. This makes it possible for unauthenticated attackers to create arbitrary Elementor templates via a forged request granted they can trick a site administrator or other user with the editposts capability into performing an action such as clicking on a link.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14163?
CVE-2025-14163 is considered a medium severity vulnerability due to its potential for unauthenticated cross-site request forgery attacks.
How do I fix CVE-2025-14163?
To fix CVE-2025-14163, update the Premium Addons for Elementor plugin to a version later than 4.11.53 that includes nonce validation.
What types of attacks can CVE-2025-14163 facilitate?
CVE-2025-14163 can facilitate cross-site request forgery attacks, allowing attackers to perform actions on behalf of users without their consent.
Which versions are affected by CVE-2025-14163?
CVE-2025-14163 affects all versions of the Premium Addons for Elementor plugin up to and including version 4.11.53.
Who can exploit CVE-2025-14163?
CVE-2025-14163 can be exploited by unauthenticated attackers due to the lack of proper nonce validation in the affected function.