CVE-2025-5944: Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5944?
CVE-2025-5944 is classified as a medium severity vulnerability due to its potential impact on user data.
How do I fix CVE-2025-5944?
To fix CVE-2025-5944, update the Element Pack Addons for Elementor plugin to version 8.0.1 or later.
What types of attacks are possible with CVE-2025-5944?
CVE-2025-5944 can be exploited to execute Stored Cross-Site Scripting attacks on affected WordPress sites.
Which versions of the Element Pack Addons for Elementor are affected by CVE-2025-5944?
CVE-2025-5944 affects all versions of the Element Pack Addons for Elementor up to and including 8.0.0.
Who is impacted by CVE-2025-5944?
Authenticated users of WordPress sites utilizing the vulnerable versions of the Element Pack Addons for Elementor plugin are impacted by CVE-2025-5944.