CVE-2025-6251: Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['fieldid'] in all versions up to, and including, 1.7.1036 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6251?
CVE-2025-6251 is a critical vulnerability due to stored cross-site scripting that can allow authenticated attackers to execute malicious scripts.
How do I fix CVE-2025-6251?
To fix CVE-2025-6251, update the Royal Elementor Addons and Templates plugin to the latest version beyond 1.7.1036.
What versions are affected by CVE-2025-6251?
CVE-2025-6251 affects all versions of the Royal Elementor Addons and Templates plugin up to and including 1.7.1036.
What type of attack does CVE-2025-6251 enable?
CVE-2025-6251 enables stored cross-site scripting attacks that can lead to the execution of arbitrary scripts in users' browsers.
Who is impacted by CVE-2025-6251?
Users of the Royal Elementor Addons and Templates plugin for WordPress who have not updated to the fixed version are at risk from CVE-2025-6251.