CVE-2025-58254

The vulnerability is a stored cross-site scripting (XSS) in the StylePress for Elementor plugin, due to improper neutralization of input during web page generation. This affects versions through 1.2.1 [1].

Exploitation requires a privileged user (e.g., admin) to perform an action such as clicking a malicious link or visiting a crafted page. The attacker does not need direct authentication but relies on social engineering to trigger the payload [1].

Successful exploitation allows an attacker to inject malicious scripts like redirects, advertisements, or other HTML payloads. These scripts execute when guest visitors access the site, potentially leading to data theft or site defacement [1].

Users should update the plugin to a version higher than 1.2.1. If unable, consulting a hosting provider or developer is recommended [1].