CVE-2025-39590: 
WordPress vulnerability analysis and mitigation

CVE-2025-39590 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in WPDeveloper Essential Addons for Elementor plugin versions through 6.1.9. The vulnerability was disclosed on April 16, 2025, affecting WordPress installations using the vulnerable plugin versions (NVD, Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation vulnerability (CWE-79). It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The issue stems from insufficient input sanitization and output escaping in the plugin (WPScan).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions, data theft, or site defacement (WPScan).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. The attack complexity is considered low, requiring user interaction for successful exploitation (Patchstack).

The vulnerability has been patched in version 6.1.10 of the Essential Addons for Elementor plugin. Site administrators are strongly advised to update to this version or later to remediate the security risk (Patchstack).