CVE-2025-48354: WordPress Better Post & Filter Widgets for Elementor plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through <= 1.6.1.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor allows Stored XSS. This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.6.0.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48354?
CVE-2025-48354 is classified as a high severity vulnerability due to its potential for Stored Cross-Site Scripting (XSS).
How do I fix CVE-2025-48354?
To fix CVE-2025-48354, update the Better Post & Filter Widgets for Elementor plugin to the latest version beyond 1.6.0.
What are the impacts of CVE-2025-48354?
CVE-2025-48354 allows attackers to execute arbitrary scripts in the context of users' browsers, potentially leading to data theft or user impersonation.
Which versions are affected by CVE-2025-48354?
CVE-2025-48354 affects versions of Better Post & Filter Widgets for Elementor up to and including 1.6.0.
Is CVE-2025-48354 present in older versions of this plugin?
Yes, CVE-2025-48354 is present in all versions prior to 1.6.0 of the Better Post & Filter Widgets for Elementor plugin.