PT-2025-32099 · WordPress · Elementskit Elementor Addons/Templates

D.Sim · Published 2025-08-06 · Updated 2025-08-06 · CVE-2025-8100

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Element Pack Elementor Addons and Templates versions through 8.1.5

Description The Element Pack Elementor Addons and Templates plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses an injected page via the marker content parameter.

Recommendations Update Element Pack Elementor Addons and Templates to a version later than 8.1.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-8100

Affected Products

Elementskit Elementor Addons/Templates

References · 7

• https://osv.dev/vulnerability/CVE-2025-8100 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3339093%40bdthemes-element-pack-lite&new=3339093%40bdthemes-element-pack-lite&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-8100 · Security Note
• https://t.me/CVEtracker/29288 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3f5d3585-19fe-4e85-87d0-7f4c62944146?source=cve · Note
• https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/open-street-map/widgets/open-street-map.php#L498 · Note
• https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-open-street-map.js#L57 · Note