WordPress Plugin Vulnerability Exposes Millions of Websites to Script Injection Attacks

A critical security vulnerability in the Essential Addons for Elementor plugin (CVE-2025-24752) has put over two million WordPress websites at risk of cross-site scripting (XSS) attacks. 

The vulnerability discovered in the plugin’s handling of user inputs allowed attackers to inject malicious scripts through crafted URLs.  Patched in version 6.0.15, this incident underscores the importance of rigorous input validation in web development.

Essential Addons for Elementor is the most popular extension bundle for the Elementor page builder, boasting over two million active installations. 

The plugin enhances WordPress sites by providing 100+ design elements, including advanced data tables, WooCommerce integrations, and dynamic galleries.

Its widespread adoption makes it a high-value target for threat actors seeking to exploit vulnerabilities at scale.

Vulnerability Exposes Websites to Script Injection Attacks

The vulnerability stemmed from improper sanitization of the popup-selector query parameter in the plugin’s src/js/view/general.js file. 

Attackers could craft URLs containing malicious JavaScript payloads in this parameter, which the plugin would reflect back to users without adequate validation. 

The flawed code replaced underscores with spaces but failed to sanitize other dangerous characters, enabling script execution in victims’ browsers.

This flaw earned the vulnerability a CVSS score of 7.1, classifying it as high severity. Successful exploitation could lead to session hijacking, phishing redirects, or unauthorized administrative access.

Researcher xssium discovers and reports the vulnerability via Patchstack Alliance. WPDeveloper addressed the flaw in version 6.0.15 by implementing strict input validation for the popup-selector parameter. 

The updated code restricts allowed characters to alphanumerics and a limited set of symbols (e.g., -, .), effectively neutralizing XSS vectors:

The fix demonstrates a defense-in-depth approach by combining client-side and server-side validation—a best practice for thwarting injection attacks.

This incident highlights three critical lessons for web developers:

• Input Validation: All user-supplied data must undergo strict whitelisting, not just blacklisting of known bad characters.
• Third-Party Risk: Popular plugins exponentially increase attack surfaces—regular audits and automated updates are essential.
• Defense Layering: Combining client-side and server-side controls reduces the likelihood of exploit chaining.

Administrators should immediately update to Essential Addons for Elementor 6.0.15 or later. The web development community can mitigate risks in an increasingly hostile digital landscape by prioritizing security hygiene and adopting a zero-trust approach to user inputs.

Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup -> Try for free