CVE-2025-13535: 
WordPress vulnerability analysis and mitigation

CVE-2025-13535 is a set of multiple Contributor+ DOM-Based Stored Cross-Site Scripting (XSS) vulnerabilities in the King Addons for Elementor WordPress plugin. All versions up to and including 51.1.38 are affected, with a partial patch introduced in version 5.1.51. The vulnerability was published on April 1, 2026, and assigned a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is insufficient input sanitization and output escaping (CWE-79) across multiple widgets and features of the plugin. Specifically, the plugin incorrectly uses esc_attr() and esc_url() within JavaScript inline event handlers (e.g., onclick attributes), which allows HTML entities to be decoded by the DOM, enabling attackers to break out of the JavaScript context. Additionally, several JavaScript files employ unsafe DOM manipulation methods — including template literals, jQuery's .html(), and window.location.href with unvalidated URLs — that process user-controlled data without proper sanitization. Affected components include the Video Popup, Off Canvas Content, Popup, Wrapper Link, Pricing Calculator, Countdown, Image Accordion widgets, and the lightgallery library (GitHub Advisory, Wordfence).

Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts via Elementor widget settings. These scripts execute when any user visits the affected page or when an administrator previews the page in Elementor's editor, potentially leading to session hijacking, credential theft, site defacement, and unauthorized actions performed on behalf of affected users. The changed scope (S:C) in the CVSS vector indicates that the impact extends beyond the vulnerable component itself to affect other users and potentially the broader WordPress site (GitHub Advisory, Wordfence).

There is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.056–0.084%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Gain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on a target site running King Addons for Elementor ≤ 51.1.38.
2. Create or Edit a Page: Use the Elementor editor to create or edit a page containing a vulnerable widget (e.g., Video Popup, Popup, Off Canvas Content, Pricing Calculator, Countdown, or Image Accordion).
3. Inject Malicious Payload: In the widget settings, insert a crafted JavaScript payload into a field that is rendered within an onclick attribute or processed by an unsafe DOM method. For example, in an onclick-bound field, inject a payload such as "><img src=x onerror=alert(document.cookie)> that, when decoded by the DOM, breaks out of the attribute context and executes arbitrary JavaScript.
4. Publish or Save the Page: Save the page so the malicious widget configuration is stored in the database.
5. Trigger Execution: The injected script executes automatically when any site visitor loads the affected page, or when an administrator previews the page in Elementor's editor — enabling session cookie theft, credential harvesting, or further malicious actions (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing unusual POST requests to Elementor widget save endpoints (e.g., wp-admin/admin-ajax.php with action=elementor_save_builder) from Contributor-level accounts; unexpected JavaScript content in widget settings fields.
• File System: No direct file system artifacts expected for stored XSS, but review the database (wp_postmeta table) for Elementor widget data containing suspicious JavaScript patterns such as <script>, onerror=, onclick=, or encoded HTML entities in widget configuration fields.
• Network: Outbound requests from victim browsers to unknown external domains (e.g., for cookie exfiltration) originating from pages containing King Addons widgets; unusual redirects via window.location.href to attacker-controlled URLs.
• Process/Behavior: Administrator accounts performing unexpected actions (password changes, new user creation, plugin installations) shortly after previewing Elementor pages — potentially indicating session hijacking via stolen cookies (Wordfence).

Update the King Addons for Elementor plugin to version 5.1.51 or later, which contains a partial patch for this vulnerability; monitor for further updates addressing remaining issues (GitHub Advisory, Wordfence). As a workaround, restrict Contributor-level access to only fully trusted users, and audit existing Elementor widget configurations for suspicious JavaScript payloads. Implementing a Content Security Policy (CSP) header and deploying a web application firewall (WAF) with XSS detection rules can provide additional defense-in-depth.

The vulnerability was discovered and reported by Wordfence, which published the threat intelligence entry and assigned the CVE (Wordfence). No significant broader media coverage, researcher commentary, or notable social media discussion has been identified for this vulnerability.