EUVD-2025-211026
GHSA-4jg6-hhpg-69r5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor authentication is required so PR:L; stored injection needs no attacker UI (UI:N); script runs in a different security context giving S:C with limited C/I and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the Ultra Addons Lite for Elementor WordPress plugin (all versions up to and including 1.3.2) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through unsanitized attributes of the plugin's Type Out widget; the script is persisted in the page and executes in the browser of any user who subsequently views it, yielding CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The flaw is a CWE-79 input-sanitization and output-escaping failure, scoped to sites that have the plugin active and that grant content-authoring accounts to untrusted users; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation currently requires deliberate attacker effort with an existing contributor account. No vendor-released patch or fixed version has been identified at time of analysis, leaving site owners dependent on removing or disabling the Type Out widget or removing the plugin until an update ships.
Technical ContextAI
The vulnerability is a stored (persistent) cross-site scripting defect, CWE-79, in the Type Out widget shipped with the Ultra Addons Lite for Elementor plugin for WordPress. Elementor widgets render their content by reading user-supplied widget attributes and echoing them into the page markup; the affected code path in elements/typeout.php (visible in the 1.2.0 tag of the plugin, around line 300, per the referenced Trac source) fails to sanitize those attributes on input and to escape them on output, so markup and script content supplied by a content author survives into the stored page. Because the payload is persisted rather than reflected, it executes each time the page is loaded, not just during the submission request. The CVSS vector records AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N: the attacker needs a low-privileged authenticated account (PR:L, consistent with WordPress contributor role and above), requires no additional victim interaction to trigger delivery of the stored payload beyond the victim loading the page (UI:N), and the scope is Changed (S:C) because the injected script runs in the security context of the victim's browser session rather than inside the plugin component itself, permitting limited confidentiality and integrity impact. The affected package is identified by CPE cpe:2.3:a:ultrapressorg:ultra_addons_lite_for_elementor:*:*:*:*:*:*:*:* and by EUVD-2025-211026 (EUVD affected range: Ultra Addons Lite for Elementor 0 through 1.3.2 inclusive). Relevant platform context: WordPress contributors can normally create and edit their own posts but are, by default, denied the unfiltered_html capability, so the practical bypass here stems from plugin-level attribute handling that does not apply WordPress' content filtering, rather than from a core capability misconfiguration.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis - the advisory covers all versions up to and including 1.3.2, and no corrected release is referenced in the available data, so operators should verify whether an updated Ultra Addons Lite build has since been published on the WordPress plugin repository and upgrade immediately if one exists. Because no fixed version is confirmed, the most effective immediate mitigation is to remove the plugin entirely from sites where the Type Out widget is not essential, which eliminates the vulnerable render path at the cost of losing all plugin features; if the plugin must stay, the Type Out widget should be disabled or removed from the widget panel and existing pages should be audited and re-saved to strip any stored payloads, accepting that this can break legitimate pages that rely on the widget's animated text. Site owners should also review and tighten WordPress role assignments, applying the principle of least privilege by removing contributor-and-above accounts from untrusted users and, where possible, withholding the ability to publish or edit pages until an official fix lands, recognizing that this restricts normal editorial workflow. Because the injection is stored and triggers on page views, a web application firewall or content-security-policy header restricting inline script execution can reduce blast radius for visitors, but such controls are bypassable and are not a substitute for removing the vulnerable widget. Monitor the vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a29959ea-af64-4a80-b46e-1e3b3cddc531?source=cve and the plugin's Trac repository at https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/ for an updated release, and note that this is a medium-severity CWE-79 issue with no public exploit identified at time of analysis and no CISA KEV listing.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today