What is the CVSS score of CVE-2025-50038?

CVE-2025-50038 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Anant Addons for Elementor are affected by CVE-2025-50038?

CVE-2025-50038 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2025-50038?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Anant Addons for Elementor CVE-2025-50038

EUVD-2025-28363 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-20 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

PR:L due to contributor access; UI:R required; scope changed (S:C) due to XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:R/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28363

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anantaddons Anant Addons for Elementor allows Stored XSS. This issue affects Anant Addons for Elementor: from n/a through 1.2.0.

AnalysisAI

Stored cross-site scripting (XSS) in Anant Addons for Elementor plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).

Technical ContextAI

The vulnerability is a stored XSS (CWE-79) in the Anant Addons for Elementor plugin, which extends the Elementor page builder for WordPress. The plugin fails to sanitize user-supplied input before storing it in the database, allowing malicious HTML/JavaScript to be embedded in page content. The CVSS vector indicates low privileges required (PR:L) and user interaction needed (UI:R), meaning an attacker must have at least contributor-level access and a victim must visit the compromised page.

RemediationAI

Update to version 1.2.1 or later if available; otherwise, restrict contributor-level access to trusted users only. As a workaround, disable the plugin or apply a web application firewall (WAF) rule to block XSS payloads. No patch version is explicitly confirmed in the input, but the advisory suggests the fix is in a version beyond 1.2.0.