PT-2025-47709 · WordPress+1 · Absolute Addons For Elementor+2

Abu Hurayra · Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-13141

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HT Mega – Absolute Addons For Elementor plugin for WordPress versions prior to 3.0.0

Description The HT Mega – Absolute Addons For Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through its Gutenberg blocks. This is caused by inadequate input validation of user-provided HTML tag names, specifically a missing tag name whitelist. Dangerous tags such as script, iframe, and object can be injected despite the use of tag escape() for sanitization. While some blocks utilize esc html() for content, this can be circumvented using JavaScript encoding techniques like unquoted strings, backticks, and String.fromCharCode(). Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.

Recommendations Update the HT Mega – Absolute Addons For Elementor plugin to version 3.0.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13141

Affected Products

Absolute Addons For Elementor

Elementor

Ht Mega – Absolute Addons For Elementor

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-13141 · Security Note
• https://t.me/CVEtracker/37921 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3398480 · Note
• https://twitter.com/CVEnew/status/1991791094837714969 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8bf04325-e313-4a68-89a0-b560bdef5a14?source=cve · Note