CVE-2025-54050
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Stored XSS.This issue affects Responsive Addons for Elementor: from n/a through <= 1.7.3.
Analysis
Stored cross-site scripting (XSS) in CyberChimps Responsive Addons for Elementor versions up to 1.7.3 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors, enabling credential theft, malware distribution, or website defacement. The vulnerability requires user interaction and affects WordPress installations using this plugin; exploitation probability is low (EPSS 0.04%) but impact is moderate given the stored nature of the attack.
Technical Context
The vulnerability stems from improper input neutralization (CWE-79) during web page generation within the Responsive Addons for Elementor WordPress plugin. The plugin fails to sanitize or escape user-controlled input before rendering it in HTML contexts, allowing authenticated attackers with the PR:L privilege level (likely Editor or Author roles) to inject arbitrary JavaScript. This input is stored in the WordPress database and executed server-side when the page is rendered to other users, creating a persistent XSS condition. The plugin integrates with Elementor, a popular WordPress page builder, making it widely deployable across WordPress installations.
Affected Products
CyberChimps Responsive Addons for Elementor WordPress plugin versions through 1.7.3 are affected. The plugin is distributed via the official WordPress plugin repository and identified by CPE cpe:2.3:a:cyberchimps:responsive_addons_for_elementor:*:*:*:*:*:wordpress:*:*. Vulnerability details are available in the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/responsive-addons-for-elementor/vulnerability/wordpress-responsive-addons-for-elementor-plugin-1-7-3-cross-site-scripting-xss-vulnerability.
Remediation
Update CyberChimps Responsive Addons for Elementor to a patched version released after 1.7.3. Site administrators should navigate to WordPress Plugins > Installed Plugins, locate Responsive Addons for Elementor, and click Update if available. If a patched version is not yet available in the WordPress plugin repository, temporarily disable the plugin and review CyberChimps' security advisory at the Patchstack reference for expected patch availability. As a mitigation pending patch deployment, restrict Editor and Author roles to trusted users only, and monitor page content for suspicious script injections.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today