CVE-2025-1039

CVE-2025-1039 is a stored cross-site scripting (XSS) vulnerability in the Lenix Elementor Leads addon plugin for WordPress, affecting all versions up to and including 1.8.2. The flaw arises from insufficient input sanitization and output escaping in a URL form field, allowing arbitrary web scripts to be injected into pages. Published on February 20, 2025, it has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is associated with CWE-79.

Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By submitting malicious payloads via the vulnerable URL form field, attackers can store scripts on affected pages, which then execute in the context of any user's browser when those pages are accessed. This enables potential theft of sensitive data, session hijacking, or further site compromise, with low impacts on confidentiality and integrity but changed scope due to cross-origin effects.

Advisories from Wordfence and WPScan provide detailed analysis of the vulnerability, while a patch is available via WordPress plugin trac changeset 3237538, which security practitioners should apply to remediate the issue in the Lenix Elementor Leads addon.