CVE-2025-7646: 
WordPress vulnerability analysis and mitigation

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter in versions up to and including 6.3.10. This vulnerability affects users with Contributor-level access and above, even when they do not have the unfiltered_html capability (Rapid7, AttackerKB).

The vulnerability is classified with a CVSS v3 Base Score of 6.4 (Medium), with an Impact Score of 2.7 and Exploitability Score of 3.1. The attack vector is Network-based (AV:N), with Low attack complexity (AC:L), requiring Low privileges (PR:L), and No user interaction (UI:N). The scope is Changed (S:C), with Low impact on both Confidentiality (C:L) and Integrity (I:L), and No impact on Availability (A:N) (AttackerKB).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page, potentially compromising the security of site visitors (Rapid7).

Users should upgrade to a version newer than 6.3.10 of The Plus Addons for Elementor plugin to mitigate this vulnerability (Rapid7).