CVE-2025-48354
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Better Post & Filter Widgets for Elementor plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Better Post & Filter Widgets for Elementor versions from n/a through 1.6.1.
Risk Assessment
A malicious script may be persistently stored in the application and executed in the browsers of users visiting affected pages, potentially leading to session theft or other actions on behalf of the user.
Recommendation
Update the Better Post & Filter Widgets for Elementor plugin to a version later than 1.6.1 if available, or implement additional input and output sanitization mechanisms.
Other vulnerabilities in Better Post & Filter Widgets for Elementor
See all- CVE-2026-115950Medium
The Better Post & Filter Widgets for Elementor plugin through version 1.9.1 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
- CVE-2026-115949Medium
The Better Post & Filter Widgets for Elementor plugin (up to version 1.9.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthenticated users to perform actions they should not have access to.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through <= 1.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS