CVE-2025-63055
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.
Analysis
Stored cross-site scripting (XSS) in Master Addons for Elementor through version 2.0.9.9.4 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising administrator accounts or stealing sensitive data. The vulnerability requires user interaction (UI:R) and affects the plugin's input sanitization during web page generation. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a lower real-world risk despite the moderate CVSS base score of 6.5.
Technical Context
The vulnerability stems from improper neutralization of user-supplied input (CWE-79) in the Master Addons for Elementor WordPress plugin, a popular page builder extension for Elementor. The plugin fails to adequately sanitize or escape user input when generating web page content, allowing attackers to inject JavaScript code that persists in the application's data store. The stored nature of this XSS means the malicious payload remains in the database and is executed whenever the affected page is rendered, distinguishing it from reflected XSS attacks that require victims to visit a malicious link. The attack vector is network-based and requires low complexity exploitation, but depends on the presence of an authenticated user account with limited privileges (PR:L) and user interaction to view the compromised content.
Affected Products
Master Addons for Elementor from version up to and including 2.0.9.9.4 is affected by this vulnerability. The plugin is a WordPress extension (CPE information not independently provided in input data) available through the WordPress plugin repository and developed by Liton Arefin. Sites running version 2.0.9.9.4 or earlier should be considered at risk. Additional version details and patch availability information can be found in the PatchStack vulnerability database referenced in the advisory.
Remediation
Update Master Addons for Elementor to the latest patched version released after 2.0.9.9.4. Plugin administrators should access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate Master Addons for Elementor, and check for available updates. If an update is available, apply it immediately to resolve the stored XSS vulnerability. As an interim measure pending patch deployment, restrict plugin access to trusted administrators with verified necessity for the feature set, and conduct security audits of existing pages using the plugin to identify any injected malicious content. For detailed remediation guidance and confirmation of available patch versions, refer to the PatchStack vulnerability advisory at https://patchstack.com/database/Wordpress/Plugin/master-addons/vulnerability/wordpress-master-addons-for-elementor-plugin-2-0-9-9-cross-site-scripting-xss-vulnerability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today