CVE-2025-32640

Vulnerability

The Elementor Ally plugin (pojo-accessibility) for WordPress versions up to and including 3.1.0 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input during web page generation. This allows attackers to inject arbitrary JavaScript that is stored and executed when the page is viewed.

Exploitation

To exploit this vulnerability, an attacker must have at least a role that allows input submission (e.g., Contributor) and craft a payload that bypasses input sanitization. The injected script is stored in the database and executed in the context of the victim's browser when they visit the affected page.

Impact

Successful exploitation results in Stored XSS, enabling the attacker to execute arbitrary JavaScript in the browsers of users who view the compromised page. This can lead to session hijacking, defacement, or redirection to malicious sites, depending on the attacker's payload.

Mitigation

Elementor has released version 4.1.1 of the Ally plugin, which is the latest version as of the reference date and likely includes a fix for this vulnerability. Users are advised to update to version 4.1.1 or later. No workarounds are described in the available reference [1].