What is the CVSS score of CVE-2025-63055?

CVE-2025-63055 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

PHP CVE-2025-63055

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-09 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.

AnalysisAI

Stored cross-site scripting (XSS) in Master Addons for Elementor through version 2.0.9.9.4 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising administrator accounts or stealing sensitive data. The vulnerability requires user interaction (UI:R) and affects the plugin's input sanitization during web page generation. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a lower real-world risk despite the moderate CVSS base score of 6.5.

Technical ContextAI

The vulnerability stems from improper neutralization of user-supplied input (CWE-79) in the Master Addons for Elementor WordPress plugin, a popular page builder extension for Elementor. The plugin fails to adequately sanitize or escape user input when generating web page content, allowing attackers to inject JavaScript code that persists in the application's data store. The stored nature of this XSS means the malicious payload remains in the database and is executed whenever the affected page is rendered, distinguishing it from reflected XSS attacks that require victims to visit a malicious link. The attack vector is network-based and requires low complexity exploitation, but depends on the presence of an authenticated user account with limited privileges (PR:L) and user interaction to view the compromised content.

Affected ProductsAI

Master Addons for Elementor from version up to and including 2.0.9.9.4 is affected by this vulnerability. The plugin is a WordPress extension (CPE information not independently provided in input data) available through the WordPress plugin repository and developed by Liton Arefin. Sites running version 2.0.9.9.4 or earlier should be considered at risk. Additional version details and patch availability information can be found in the PatchStack vulnerability database referenced in the advisory.

RemediationAI

Update Master Addons for Elementor to the latest patched version released after 2.0.9.9.4. Plugin administrators should access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate Master Addons for Elementor, and check for available updates. If an update is available, apply it immediately to resolve the stored XSS vulnerability. As an interim measure pending patch deployment, restrict plugin access to trusted administrators with verified necessity for the feature set, and conduct security audits of existing pages using the plugin to identify any injected malicious content. For detailed remediation guidance and confirmation of available patch versions, refer to the PatchStack vulnerability advisory at https://patchstack.com/database/Wordpress/Plugin/master-addons/vulnerability/wordpress-master-addons-for-elementor-plugin-2-0-9-9-cross-site-scripting-xss-vulnerability.