CVE-2025-22500

The vulnerability is an improper neutralization of input during web page generation that permits the execution of arbitrary JavaScript in the web browser of a site visitor. The plugin’s output is vulnerable to DOM‑based cross‑site scripting, meaning that a crafted payload delivered through the plugin can run client‑side code when the page is rendered. The effect of that code execution depends on the victim’s context but can be used to collect sensitive information or modify page content. The flaw is specifically caused by a weakness identified as CWE‑79. It does not provide an attacker with elevated privileges on the server or the ability to modify server‑side files; the impact is limited to the client side of the web application. The CVSS score of 6.5 reflects a moderate severity based on the potential impact on users, while the EPSS score of <1 % indicates that, at the time of this analysis, exploitation is considered unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation typically involves an attacker supplying a malicious payload that the plugin fails to sanitize, resulting in script execution when a visitor loads a page that includes the plugin’s content. The attack would generally require the victim to view the affected page, making it a user‑interaction dependent threat.

The Alpha Price Table For Elementor plugin, supplied by Ali Ali, is affected in all releases from the beginning through version 1.2.0.

Exploitability is moderate with a CVSS score of 6.5 reflecting the potential impact on users. The EPSS score of <1 % indicates that, at the time of this analysis, exploitation is considered unlikely. The flaw is not listed in the CISA KEV catalog. The vulnerability manifests as DOM‑based cross‑site scripting, requiring an attacker to supply a malicious payload that the plugin fails to sanitize; when a visitor loads a page containing the plugin, the script executes in the visitor’s browser. This client‑side code can read cookies, modify page content, or launch phishing attacks. Because it relies on user interaction (the victim viewing a page) and does not affect the server or other sites, the risk is limited to the affected website’s visitors.