Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSummary
CVE-2025-1441 is a medium-severity CSRF (CWE-352) vulnerability in Royal-Elementor-Addons Royal Elementor Addons. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-1441, published on 2025-02-19, is a Cross-Site Request Forgery (CSRF) vulnerability classified under CWE-352, affecting the Royal Elementor Addons and Templates plugin for WordPress in all versions up to and including 1.7.1007. The flaw arises from missing or incorrect nonce validation in the 'wpr_filter_woo_products' function, which fails to properly verify requests.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity by tricking a site administrator into executing a forged request, such as clicking a malicious link. Exploitation enables the injection of malicious web scripts, leading to low impacts on confidentiality and integrity with a changed scope, as reflected in the CVSS v3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Advisories indicate mitigation through updating to version 1.7.1008, where source code changes around line 1904 in the 'wpr-filter-woo-products.php' file address the nonce validation deficiency compared to line 1895 in the vulnerable 1.7.1007 tag. Further details are provided in Wordfence threat intelligence.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4753
Vulnerability Data
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wpr_filter_woo_products' function. This makes it possible…
more
for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement requires verifying that state-changing requests originate from the authenticated user rather than a forged cross-site source.
Protecting session authenticity prevents attackers from replaying or forging authenticated requests via the victim's browser.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.