What is the CVSS score of CVE-2025-12537?

CVE-2025-12537 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Addon Elements CVE-2025-12537

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-14 security@wordfence.com

WordPress XSS Wordpress Plugin Elementor

6.4

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Contributor authentication is required so PR:L (not PR:N); stored XSS executes in other users' contexts giving S:C with limited C:L/I:L and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 07, 2026 - 20:40 vuln.today

tag: Elementor added

Analysis Generated

Oct 07, 2026 - 20:08 vuln.today

CVE Published

Dec 14, 2025 - 06:15 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.14.3. This is due to insufficient input sanitization and output escaping on multiple widget parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via multiple widget parameters in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the WordPress plugin Addon Elements for Elementor (all versions up to and including 1.14.3) allows authenticated attackers holding Contributor-level privileges or above to inject arbitrary JavaScript through multiple widget parameters, which then executes when any user - including administrators - views the affected page. Exploitation is authentication-gated and requires the plugin to be installed with one of the affected widgets placed on a page the attacker can edit, so sites that do not grant untrusted users Contributor rights are largely unexposed. Risk is moderate: EPSS is only 0.23% (13th percentile), there is no CISA KEV listing, and no public exploit code identified at time of analysis, though the upstream code change tied to this issue is visible in the public plugin repository.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting), specifically the stored variant. Addon Elements is a widget-pack extension for the Elementor page builder; its widgets accept user-supplied parameters that are persisted as part of the page content but are neither sanitized on input nor escaped on output before being rendered into the page markup. Because Elementor content is stored in the WordPress database and rendered to every visitor of that page, a payload planted in a widget parameter survives across requests and executes in the browser context of each subsequent viewer - the classic stored-XSS escalation path from a low-privileged authoring role to compromise of higher-privileged sessions. The assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms a network-reachable, low-complexity issue requiring low privileges (PR:L), with scope change (S:C) reflecting that the injected script executes in a context beyond the vulnerable component, and limited confidentiality and integrity impact (C:L/I:L) but no availability impact.

Affected ProductsAI

The affected product is the WordPress plugin 'Addon Elements for Elementor', all versions from the initial release up to and including 1.14.3, as installed on WordPress sites running the Elementor page builder. No CPE identifiers were provided in the source data, so the version ceiling (≤ 1.14.3) is the authoritative boundary rather than a CPE string. Any site with this plugin active and at least one affected widget present on a page editable by a Contributor-or-higher account is in scope. Vendor/third-party advisory detail is available in the Wordfence threat-intelligence entry (https://www.wordfence.com/threat-intel/vulnerabilities/id/94217d06-21c2-443d-ae2c-a2dbd65b7908?source=cve), and the code-level change relevant to the flaw is visible in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset/3415227/addon-elements-for-elementor-page-builder/trunk/assets/js/eae.js.

RemediationAI

Update the Addon Elements for Elementor plugin to a release newer than 1.14.3 that incorporates the upstream code change referenced by the plugin repository changeset (trac changeset 3415227); an upstream fix is available in the repository tree, but an exact patched release version number is not confirmed by the supplied data, so verify the installed version against the vendor changelog before assuming you are fixed. As compensating controls where immediate updating is not possible, restrict who can hold Contributor-or-higher roles to reduce the pool of accounts able to plant stored payloads, and audit or temporarily disable the affected Addon Elements widgets on pages editable by untrusted users - noting that disabling widgets will remove their rendered content from live pages and may break existing layouts. Because the flaw is stored, also review existing pages for injected markup and clean any that are found, and consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/94217d06-21c2-443d-ae2c-a2dbd65b7908?source=cve) for widget-specific detail. General hardening such as Content Security Policy can limit payload impact but is not a substitute for patching.