CVE-2025-6252: 
WordPress vulnerability analysis and mitigation

The Qi Addons For Elementor plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-6252) that affects all versions up to and including 1.9.1. The vulnerability was disclosed on June 28, 2025, and has been assigned a CVSS v3.1 Base Score of 6.4 (MEDIUM) (NVD, Wiz).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and stems from insufficient input sanitization and output escaping in several parameters of the plugin. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, and required privileges (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to data theft, session hijacking, or other client-side attacks (NVD, Wiz).

A patch has been implemented in the plugin's codebase as evidenced by changes in the main.js file. Users should update their installations to a version newer than 1.9.1 when available (WordPress Plugin).