Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows DOM-Based XSS.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2.
Published: 2025-10-31
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a DOM‑Based Cross‑Site Scripting (XSS) flaw in StylemixThemes Consulting Elementor Widgets, affecting versions up to 1.4.2. An attacker can inject JavaScript payloads by manipulating data that the plugin incorporates directly into the rendered page, because the plugin fails to properly neutralize user input. The flaw is classified as CWE‑79.

Affected Systems

Any WordPress installation running the Consulting Elementor Widgets plugin from StylemixThemes with a version up to and including 1.4.2 is vulnerable. All deployments that employ this plugin, regardless of other themes or plugins, are impacted and must verify the installed version.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity. The EPSS score of less than 1% suggests a low exploitation probability. The flaw is not listed in the CISA KEV catalog. Because the vulnerability is DOM‑based, it can be exploited by supplying manipulated data or a crafted URL; authentication is not required.

Generated by OpenCVE AI on April 29, 2026 at 16:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Consulting Elementor Widgets plugin to version 1.4.3 or later, removing all releases up to 1.4.2.
  • If an immediate update is not possible, restrict the plugin’s input fields to safe content, enforce server‑side sanitization, or implement a Content Security Policy that blocks inline scripts generated by the widget.
  • Employ a Web Application Firewall or security plugin that detects and blocks XSS attempts targeting the plugin’s parameters.

Generated by OpenCVE AI on April 29, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Thu, 13 Nov 2025 11:30:00 +0000

Type Values Removed Values Added
References

Thu, 13 Nov 2025 10:45:00 +0000

Type Values Removed Values Added
References

Mon, 03 Nov 2025 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Stylemixthemes
Stylemixthemes consulting Elementor Widgets
Wordpress
Wordpress wordpress
Vendors & Products Stylemixthemes
Stylemixthemes consulting Elementor Widgets
Wordpress
Wordpress wordpress

Fri, 31 Oct 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 31 Oct 2025 11:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows DOM-Based XSS.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2.
Title WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

Stylemixthemes Consulting Elementor Widgets
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T18:30:50.689Z

Reserved: 2025-10-31T11:23:15.209Z

Link: CVE-2025-64361

cve-icon Vulnrichment

Updated: 2025-10-31T17:59:55.341Z

cve-icon NVD

Status : Deferred

Published: 2025-10-31T12:15:36.580

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-64361

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T16:30:15Z

Weaknesses