CVE-2025-3275

Summary

CVE-2025-3275 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Themesflat Addons For Elementor plugin for WordPress. This issue, present in all versions up to 2.2.5, allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages via the TF E Slider widget. The insufficient input sanitization and output escaping in this plugin create an exploitable condition that causes the injected scripts to execute whenever a user accesses an affected page. This vulnerability poses a serious risk, as it enables attackers to steal sensitive information or even take control of affected websites. It is strongly recommended that users of this plugin upgrade to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.