CVE-2025-59592
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-22

Last updated on: 2026-04-23

Assigner: Patchstack

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fernando Acosta Make Column Clickable Elementor make-column-clickable-elementor allows Stored XSS.This issue affects Make Column Clickable Elementor: from n/a through <= 1.6.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-22
Last Modified
2026-04-23
Generated
2026-06-16
AI Q&A
2025-09-22
EPSS Evaluated
2026-06-15
NVD
CVE-2025-59592
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack make_column_clickable_elementor *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross Site Scripting (XSS) issue in the WordPress Make Column Clickable Elementor Plugin up to version 1.6.0. It allows an attacker with at least contributor-level privileges to inject malicious scripts into a website. These scripts can execute when visitors access the site, potentially causing redirects, displaying unwanted advertisements, or executing other harmful HTML payloads. [1]

Impact Analysis

The vulnerability can impact you by allowing attackers to inject malicious scripts that execute in the browsers of your website visitors. This can lead to unwanted redirects, display of malicious advertisements, or other harmful actions that compromise user experience and security. It may also lead to partial compromise of confidentiality, integrity, and availability of your site as indicated by the CVSS score. [1]

Detection Guidance

Detection of this vulnerability involves checking if the WordPress Make Column Clickable Elementor Plugin is at version 1.6.0 or earlier, as these versions are vulnerable. Additionally, monitoring for unusual script injections or unexpected HTML payloads in the website content can indicate exploitation attempts. While specific commands are not provided, users can audit plugin versions via WordPress CLI commands such as 'wp plugin list' to verify the installed version. For deeper inspection, scanning the website files and database for injected scripts or using server-side malware scanning tools is recommended. [1]

Mitigation Strategies

Immediate mitigation steps include updating the Make Column Clickable Elementor Plugin to version 1.6.1 or later, where the vulnerability is fixed. If immediate updating is not possible, applying virtual patching (vPatching) provided by Patchstack can auto-mitigate the vulnerability. Additionally, professional incident response and server-side malware scanning are recommended if a site is suspected to be compromised. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-59592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart