The Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the $anber_item[‘button_link’][‘url’] parameter. This vulnerability affects all versions up to and including 1.0.1. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts that execute when users access the affected pages.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-7439 |
Exploitation
To exploit this vulnerability, an authenticated attacker with Contributor-level access can craft a malicious payload and inject it into the $anber_item[‘button_link’][‘url’] parameter. When a user accesses the page containing the injected script, it will execute in their browser, potentially leading to session hijacking or other malicious actions.
Affected Products
- Anber Elementor Addon plugin for WordPress (all versions up to and including 1.0.1): Vulnerable to Stored Cross-Site Scripting due to improper input handling.
Mitigation
To mitigate this vulnerability, users should update the Anber Elementor Addon plugin to the latest version that addresses the input sanitization and output escaping issues. Additionally, implementing strict input validation and sanitization practices can help prevent similar vulnerabilities in the future.