CVE-2025-39543: WordPress Royal Elementor Addons plugin <= 1.3.977 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS. This issue affects Royal Elementor Addons: from n/a through 1.3.977.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.3.977.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39543?
CVE-2025-39543 is classified as a medium severity vulnerability due to the potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2025-39543?
To fix CVE-2025-39543, update the Royal Elementor Addons plugin to the latest version above 1.3.977.
What versions are affected by CVE-2025-39543?
CVE-2025-39543 affects all versions of Royal Elementor Addons up to and including version 1.3.977.
What kind of attack does CVE-2025-39543 enable?
CVE-2025-39543 enables stored cross-site scripting (XSS) attacks, allowing attackers to inject malicious scripts into web pages.
Is CVE-2025-39543 specific to a particular platform?
Yes, CVE-2025-39543 is specific to the WP Royal Royal Elementor Addons plugin used within WordPress.