CVE-2025-1054 is a stored cross-site scripting vulnerability in the UiCore Elements – Free widgets and templates plugin for Elementor on WordPress. It arises from improper neutralization of input during web page generation (CWE-79) in several widgets, allowing authenticated users with Contributor or higher roles to inject arbitrary scripts. These scripts execute in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.0.16. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

An attacker with Contributor-level access or higher can store malicious scripts in affected widgets, which execute when other users access the injected pages. This can lead to unauthorized actions performed in the context of the victim's browser, such as session theft or defacement. The impact is limited to confidentiality and integrity, with no direct availability impact. Since the attacker must be authenticated with at least Contributor privileges, the risk is somewhat mitigated by access controls but remains significant in environments where such roles are assigned to untrusted users.

No official patch or remediation guidance is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the affected widgets if possible. Monitor for plugin updates from the vendor that address this vulnerability.