CVE-2025-64361

WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Oct 31, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows DOM-Based XSS.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2.

Analysis

AI-generated

Technical impact

The vulnerability is a DOM‑Based Cross‑Site Scripting (XSS) flaw in StylemixThemes Consulting Elementor Widgets, affecting versions up to 1.4.2. An attacker can inject JavaScript payloads by manipulating data that the plugin incorporates directly into the rendered page, because the plugin fails to properly neutralize user input. The flaw is classified as CWE‑79.

Affected Systems

Any WordPress installation running the Consulting Elementor Widgets plugin from StylemixThemes with a version up to and including 1.4.2 is vulnerable. All deployments that employ this plugin, regardless of other themes or plugins, are impacted and must verify the installed version.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity. The EPSS score of less than 1% suggests a low exploitation probability. The flaw is not listed in the CISA KEV catalog. Because the vulnerability is DOM‑based, it can be exploited by supplying manipulated data or a crafted URL; authentication is not required.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Consulting Elementor Widgets plugin to version 1.4.3 or later, removing all releases up to 1.4.2.
  • If an immediate update is not possible, restrict the plugin’s input fields to safe content, enforce server‑side sanitization, or implement a Content Security Policy that blocks inline scripts generated by the widget.
  • Employ a Web Application Firewall or security plugin that detects and blocks XSS attempts targeting the plugin’s parameters.

Generated by OpenCVE AI on April 29, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Stylemixthemes
Stylemixthemes consulting Elementor Widgets
Wordpress
Wordpress wordpress
Vendors & Products Stylemixthemes
Stylemixthemes consulting Elementor Widgets
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows DOM-Based XSS.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2.
Title WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Earlier changes (2)
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 6:30 PM
Reserved
Oct 31, 2025, 11:23 AM

View source JSON

Updated
Oct 31, 2025, 5:59 PM

JSON

Status
Deferred
Published
Oct 31, 2025, 12:15 PM
Modified
Jun 17, 2026, 9:54 AM

View source JSON

No data.

Updated
Apr 29, 2026, 4:30 PM

JSON