CVE-2025-4943 is a stored cross-site scripting vulnerability in the LA-Studio Element Kit for Elementor WordPress plugin. It affects all versions up to 1.5.2 and is caused by improper neutralization of input in the 'data-lakit-element-link' parameter. Authenticated users with Contributor-level privileges or higher can inject arbitrary web scripts that execute when other users access the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N). No patch or remediation details have been provided by the vendor, and the plugin is not a cloud service, so remediation depends on plugin updates from the vendor.

An attacker with Contributor-level or higher privileges can exploit this vulnerability to inject stored malicious scripts into pages, which execute in the context of other users viewing those pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the affected plugin. Monitor official vendor channels for updates and apply patches promptly once available.