CVE-2025-8603: Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8603?
CVE-2025-8603 is a moderate severity vulnerability due to the risk of stored cross-site scripting attacks.
How do I fix CVE-2025-8603?
To fix CVE-2025-8603, update the Unlimited Elements For Elementor plugin to version 1.5.149 or later.
Who is affected by CVE-2025-8603?
All users of the Unlimited Elements For Elementor plugin on WordPress prior to version 1.5.149 are affected by CVE-2025-8603.
What type of vulnerability is CVE-2025-8603?
CVE-2025-8603 is a stored cross-site scripting (XSS) vulnerability.
Can authenticated attackers exploit CVE-2025-8603?
Yes, authenticated attackers can exploit CVE-2025-8603 to inject malicious scripts into the site.