CVE-2025-1663 Unlimited Elements For Elementor <= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting
MediumCVSS 5.4
EPSS 0.23%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| unitecms Unlimited Elements For Elementor | <= 1.5.142 | No fix listed |
| unlimited-elements unlimited elements for elementor | <= 1.5.142 | No fix listed |
| wordpress unlimited-elements-for-elementor(WordPress) | < 1.5.143 | 1.5.143 |
References
- www.wordfence.com third-party-advisory
- plugins.trac.wordpress.org patch
- Wordfence Intelligence third-party-advisory
- www.cve.org