CVE-2025-6550

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-6550
The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/carousel_parallax/view.php#L25 Product
https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_1/view.php#L31 Product
https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_4/view.php#L57 Product
https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/sliderparallax/view.php#L37 Product
https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_1/one.php#L46 Product
https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_5/one.php#L33 Product
https://plugins.trac.wordpress.org/changeset/3320280/
https://plugins.trac.wordpress.org/changeset/3321887/
https://www.wordfence.com/threat-intel/vulnerabilities/id/4af2f136-5806-4d5e-a72d-486c4839a695?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:webangon:the_pack_elementor_addons:*:*:*:*:*:wordpress:*:*
History

08 Jul 2025, 22:15

Type Values Removed Values Added
References
  • () https://plugins.trac.wordpress.org/changeset/3320280/ -
  • () https://plugins.trac.wordpress.org/changeset/3321887/ -
Summary The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CWE CWE-79

07 Jul 2025, 15:38

Type Values Removed Values Added
CPE cpe:2.3:a:webangon:the_pack_elementor_addons:*:*:*:*:*:wordpress:*:*
First Time Webangon
Webangon the Pack Elementor Addons
References () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_1/view.php#L31 - () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_1/view.php#L31 - Product
References () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_4/view.php#L57 - () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_4/view.php#L57 - Product
References () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/carousel_parallax/view.php#L25 - () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/carousel_parallax/view.php#L25 - Product
References () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_5/one.php#L33 - () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_5/one.php#L33 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/4af2f136-5806-4d5e-a72d-486c4839a695?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/4af2f136-5806-4d5e-a72d-486c4839a695?source=cve - Third Party Advisory
References () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/sliderparallax/view.php#L37 - () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/sliderparallax/view.php#L37 - Product
References () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_1/one.php#L46 - () https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_1/one.php#L46 - Product
CVSS v2 : unknown
v3 : 6.4 		v2 : unknown
v3 : 5.4

27 Jun 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-27 08:15

Updated : 2025-07-08 22:15

NVD link : CVE-2025-6550

Mitre link : CVE-2025-6550

JSON object : View

Products Affected

webangon

  • the_pack_elementor_addons
CWE

No CWE.