PT-2025-27067 · WordPress · Pack Elementor

Matthew Rollings · Published 2025-06-27 · Updated 2025-07-08 · CVE-2025-6550

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Pack Elementor plugin for WordPress versions up to and including 2.1.3

Description: The issue is related to stored cross-site scripting, allowing authenticated attackers with contributor or higher access to inject arbitrary web scripts in pages. This is due to insufficient input sanitization and output escaping through the slider options parameter. The scripts will execute when a user accesses an injected page.

Recommendations: For versions up to and including 2.1.3, update to a version higher than 2.1.3 to resolve the issue. As a temporary workaround, consider restricting access to the slider options parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-6550

Affected Products

Pack Elementor

References · 16

• https://osv.dev/vulnerability/CVE-2025-6550 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6550 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4af2f136-5806-4d5e-a72d-486c4839a695?source=cve · Note
• https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_4/view.php#L57 · Note
• https://t.me/cvenotify/128085 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1938528114570612953 · Twitter Post
• https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/carousel_parallax/view.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_1/view.php#L31 · Note
• https://t.me/cvetracker/27221 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3320280 · Note
• https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_1/one.php#L46 · Note
• https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_5/one.php#L33 · Note
• https://t.me/cvenotify/126847 · Telegram Post
• https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/sliderparallax/view.php#L37 · Note
• https://plugins.trac.wordpress.org/changeset/3321887 · Note