CVE-2025-3106: 
WordPress vulnerability analysis and mitigation

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in versions up to and including 1.4.9. The vulnerability was discovered and disclosed on April 18, 2025 (NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the Table of Contents widget. This security flaw has been assigned CVE-2025-3106 and has received a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue has been classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized data access or manipulation of user sessions (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring no special conditions or circumstances for exploitation (NVD).

The vulnerability has been patched in version 1.5.0 of the LA-Studio Element Kit for Elementor plugin. Users are advised to update to this version or later to protect against this security issue (WordPress Plugin).