CVE-2025-7646 is a stored cross-site scripting vulnerability (CWE-79) in The Plus Addons for Elementor plugin for WordPress, affecting all versions up to 6.3.10. The flaw arises from improper neutralization of input in the custom script parameter, allowing authenticated users with Contributor-level privileges or higher to inject malicious scripts into pages. These scripts execute whenever the injected page is accessed by any user, potentially leading to client-side code execution. The vulnerability does not require unfiltered_html capability, broadening the scope of potential attackers. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope changed, and limited confidentiality and integrity impact.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the custom script parameter. These scripts execute in the context of users viewing the compromised pages, potentially leading to theft of session cookies, defacement, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. Since the vulnerability allows scope change, it can affect users beyond the initial attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the custom script parameter if possible. Monitor for plugin updates from posimyththemes addressing this issue.