CVE-2025-46472: 
WordPress vulnerability analysis and mitigation

CVE-2025-46472 is a Cross-site Scripting (XSS) vulnerability discovered in The Pack Elementor addons WordPress plugin. The vulnerability affects versions up to 2.1.2 and was disclosed on April 24, 2025. This stored XSS vulnerability requires authenticated access with Contributor or higher privileges to exploit (Patchstack, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 score of 6.5 (Medium). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating that the vulnerability requires network access, low attack complexity, low privileges, and user interaction (NVD).

If exploited, this vulnerability could allow authenticated attackers to inject malicious scripts into the website. These scripts could be used to create redirects, insert unwanted advertisements, or execute other malicious HTML payloads that would affect visitors to the affected website (Patchstack).

The vulnerability requires an authenticated user with at least Contributor-level access to exploit. It has been classified as having a low attack complexity, indicating that it is relatively straightforward to exploit once the necessary access level is obtained (Patchstack).

As of the vulnerability disclosure, no official fix has been made available for this security issue. The vulnerability is considered to have a low severity impact and is unlikely to be exploited (Patchstack).