CVE-2025-8689 is a stored cross-site scripting vulnerability in the Elements Plus! WordPress plugin by cssigniterteam, affecting all versions up to 2.16.4. The issue stems from improper neutralization of input during web page generation (CWE-79), specifically in the Image Comparison, HotSpot Plus, and Google Maps widgets. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts via insufficiently sanitized user attributes. These scripts execute in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages using vulnerable widgets. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of users. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling the affected widgets (Image Comparison, HotSpot Plus, and Google Maps) if possible to reduce risk.