What is the CVSS score of CVE-2025-12830?

CVE-2025-12830 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-12830

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-12 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Dec 12, 2025 - 04:15 nvd

MEDIUM 6.4

DescriptionCVE.org

The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Better Elementor Addons plugin for WordPress up to version 1.5.5 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript through insufficiently sanitized Slider widget attributes, which executes when any user views the affected page. This is a stored XSS vulnerability affecting a widely-deployed WordPress plugin; no public exploit code or active exploitation has been confirmed at time of analysis, but the low CVSS complexity (AC:L) and moderate EPSS exploitation probability make this a practical concern for any WordPress site running the vulnerable plugin versions with user roles permitted to edit pages.

Technical ContextAI

The Better Elementor Addons plugin integrates custom widgets into the Elementor page builder ecosystem. The vulnerability resides in the Slider widget's style rendering components (style1.php, style2.php, style5.php) where user-supplied widget attributes are output directly into HTML/CSS contexts without proper escaping or sanitization. This is a classic CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') flaw-the application constructs dynamic HTML from user input intended for visual styling but fails to escape special characters that could break out of the attribute context and inject script tags or event handlers. WordPress plugins extending Elementor must sanitize inputs at the point of acceptance and escape outputs at the point of rendering; this plugin appears to have failed on the output escaping step, making stored XSS possible.

Affected ProductsAI

Better Elementor Addons for WordPress is affected in all versions up to and including 1.5.5. The plugin is distributed via the official WordPress.org plugin repository (https://wordpress.org/plugins/better-elementor-addons/). No CPE string is available from the provided data, but the vulnerability specifically impacts the Slider widget component across all affected releases. Sites running version 1.5.6 or later are no longer affected, assuming the patched version addresses the sanitization/escaping gaps.

RemediationAI

Update Better Elementor Addons to version 1.5.6 or later, which patches the insufficient input sanitization and output escaping issues in the Slider widget. The patch can be applied directly via the WordPress plugin update interface or by downloading the latest version from https://wordpress.org/plugins/better-elementor-addons/. Site administrators should verify the update completes successfully and test slider widgets post-upgrade. As a temporary workaround pending updates, restrict contributor-level access to page editing to trusted users only, or disable the Slider widget if it is not actively used. For further details, consult the Wordfence security advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d714d740-d7e0-49fd-af08-b4a80c9d0599.