Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

An attacker exploiting CVE-2025-3075 can inject arbitrary JavaScript code into pages accessible to users with contributor-level access or higher. This injected script executes whenever a user visits the compromised page, enabling the attacker to steal cookies, redirect users to malicious websites, or deface the website. The impact is amplified if the website handles sensitive user data, as attackers could potentially gain access to credentials or other confidential information. The requirement for 'Element Caching' to be enabled narrows the scope, but still represents a significant risk for sites utilizing this feature.

WordPress websites utilizing the Elementor Website Builder plugin, particularly those with 'Element Caching' enabled, are at risk. Shared hosting environments where users have contributor-level access or higher are especially vulnerable, as they provide a potential attack vector for malicious script injection.

• wordpress / composer / npm:

grep -r 'elementor-element shortcode' /var/www/html/wp-content/plugins/elementor/src/

• wordpress / composer / npm:

wp plugin list --status=active | grep elementor

• wordpress / composer / npm:

wp plugin update elementor

• generic web: Check Elementor plugin version using curl -I <wordpresssiteurl>/wp-content/plugins/elementor/elementor.php and verify it's >= 3.30.0.

1. 2025-07-29Disclosure

   disclosure

1. Reserviert2025-03-31
2. Veröffentlicht2025-07-29
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-3075 is to upgrade the Elementor plugin to version 3.30.0 or later. If immediate upgrading is not feasible, consider disabling 'Element Caching' as this is a prerequisite for exploitation. Implement a Web Application Firewall (WAF) with rules to detect and block suspicious JavaScript injections within Elementor shortcodes. Regularly review user roles and permissions to ensure only necessary access is granted. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload through the 'elementor-element' shortcode and verifying that it is properly sanitized.

Aktive Installationen

10.0MBeliebt

Plugin-Bewertung